94b505556bc8c8986b54c2a42cd516c142c46e92155a7ce17894c5f2bde62d64

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260424-plbptaat5j
SHA256 94b505556bc8c8986b54c2a42cd516c142c46e92155a7ce17894c5f2bde62d64
MD5 3d43609a8b3a4f346725e3f8b9a11da8
SHA1 8e7040fdab222ecb6081633fd3368cfcb1b78521
SHA512 682ac6f4f92b266a7b1a706edc923ab44becc8d8577433176a163afa36b772b303a2fc653efca2e418ab5d0714cbc646805f2b4970adfa68670d1b0c32f62391
SSDEEP 12288:U6PCrIc9kph5Ezpecp3nMzuQxTLikjpo:U6QIcOh5EdM9xp
TLSH
T15A94D03435C5C037E29316308AEADA63193A7D758B62A8CB3BD467AE5E702D1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3872	3F65.tmp

Executes dropped EXE 1 IoCs

pid	Process
3872	3F65.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F65.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3872	3F65.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3872	1724	2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\3F65.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F65.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe 6EC8279DA9BFF4BEF69C5AF86DA2F3DDCB6A81417C87E41225B925CC3D776006F76F5399E44AF9AB492BD536B96D3782A338348795F139EFE20293D4C0E8BC8D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3F65.tmp

Path C:\Users\Admin\AppData\Local\Temp\3F65.tmp
Size 412KB
SHA256 f551993cb2c8d4f0ab6d8b76dda71580b0532943092ce50f1dd20a9a4ed0b5c7
MD5 1820442fe3f8ab8f7d06dc250a925d30
SHA1 083e9afefb8f40428de6b70e989f2702cdfd4ada
SHA512 09fd88a79d7d7abb0502bb8798b3e284e7eacc88eecf618ef42704b64b6c8f3a63cf1b8b65212e9e4310a67cf0cb7aad57929f00534a525ccb1e3ab7c02596a1
SSDEEP 12288:U6PCrIc9kph5Fd4J52xZptxkY1/kA/whR/95:U6QIcOh5Lc2xNx91M/P/
TLSH
T17494E0303685C036E2A706318AEADB66193E7D754B2268C777D06BAE6E703D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads