9ad378c7e8040a1714c46eb94f396dc20de5ff4503374f1c1ec28961f61cbf44

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260423-wcf2hadw2x
SHA256 9ad378c7e8040a1714c46eb94f396dc20de5ff4503374f1c1ec28961f61cbf44
MD5 6ea197fb5e51e67ffd719f97096e5ce9
SHA1 79418c8fbb5fa97fa97292af59ba9f9d05597c7f
SHA512 c1a0e33a5fb875c558273fa55af6480dd741fdd5689dd0e4ec02c175ac4ee4ee655d53496ee4c9d9bae788ccf9e7222407597744f4d2c9cbb25106bfd7120c13
SSDEEP 12288:Z594+AcL4tBekiuKzErgA2+67kLBsnBNJGFArwl:BL4tBekiuVrBF67klsUx
TLSH
T13D94F0353486C033E29715384FF5D7AA5A7E39B64B2668CB3BD01B695FA02C2D73434A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5480	2BCE.tmp

Executes dropped EXE 1 IoCs

pid	Process
5480	2BCE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2BCE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5480	4876	2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\2BCE.tmp
  "C:\Users\Admin\AppData\Local\Temp\2BCE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe E6AE9A5D63DD2A26A1A8F2A4515C751E1D4D3E1BDC3F6C3A16348261DE8BCC65CA40A4D86DD103894D7ED9A5980CC1007CDF8875B3BC2D847C3BF99A3FE8EFB3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2BCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\2BCE.tmp
Size 428KB
SHA256 17eb5bb82eae332083817613b3698ec96fb79a45f8e8da21fd771f2e470fa760
MD5 1978ca2d6588727c01b444510f811b4b
SHA1 4230cc25d327266624680a4e746181f5aa28bfb9
SHA512 602966edba86cb676d78c316035ae72014d2ad42a46a2308800feba2c4399e01746b8c1a26aea81fd55e0ebee8fae2c9c24917826c9c24d5a0f8f4f0b717498d
SSDEEP 12288:Z594+AcL4tBekiuKzErbLyT/4PNQDYtjPVGg9to/xdqvbl:BL4tBekiuVrfyL4ftEOAG
TLSH
T13A94F0393081C033E29718384FE5CB65597A7AA14B26A8C77BD41B7E6F642D2DB3035B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4876-4-0x00000000009C0000-0x00000000009D8000-memory.dmp

Download

memory/5480-5-0x0000000001350000-0x0000000001368000-memory.dmp