97ef45fd136b0862950578085b7817eedb4a2be4d336a984789f6a3802a0d8f9

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260424-erba5aev6v
SHA256 97ef45fd136b0862950578085b7817eedb4a2be4d336a984789f6a3802a0d8f9
MD5 816a95e588eedb9808b6c4ddf9bf02fc
SHA1 5290ae1705b20b7bfb220539a57594c5a4de5c06
SHA512 c82c940b82e369dac147ed58fe3c47ac72dd99803029d148aa1696be6c4710c276565897358f98c699ba00220f7b50bf242c82a6371d785012c8baaafc0a0280
SSDEEP 12288:3O4rfItL8HPOVfuN5lnSYZsoUurmCvJtx5Tx7rKxUYXhW:3O4rQtGPWfsblnx593KxUYXhW
TLSH
T158B4F12A7681C233D28302351BD6DADAA73E75B14776A4C337D4427D1FA1AE1D33A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3632	28EF.tmp

Executes dropped EXE 1 IoCs

pid	Process
3632	28EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3632	3416	2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\28EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\28EF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe 91E1F21B4D21279427BF9757352769FD0FAAAE4A2D2155A8254E80439D6FFC5490C6E85F02171A768E05021D3F745E5643520E21D1E5D44AE70012E186217058
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\28EF.tmp
Size 486KB
SHA256 a341ade8cc741ac0051d3ad9ca22a252171ee09886f7476dadaaad5c3d65d843
MD5 3baf14cbe8a973bc2a3096626f334f76
SHA1 4932b01f01da6233a65c66257a6522bd51c87d73
SHA512 9e7bd53b04f0e034fe75b6930cb35eecb588382cce658632cdaca34d278c8001ac82a9e59829e55be18dff60737a5c7b647e76918966d144002c74622a03c5dc
SSDEEP 12288:3O4rfItL8HPC4tOkH8r4OAqA9YEI7Ll17vb7rKxUYXhW:3O4rQtGPNtOkH8r4mCYE61X3KxUYXhW
TLSH
T1BBB4F12A76418233D2D301711BDBD7D6AB3E75B1572694C33B98026D1FB1AE2D33A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3416-3-0x00000000008F0000-0x000000000094F000-memory.dmp

Download

memory/3632-5-0x0000000001300000-0x000000000135F000-memory.dmp