9df5ce2b0e381f5c3795734ccd037fa5f49f9bcc1edda09a52b7140a25bf6b0d

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260424-ppynraav6k
SHA256 9df5ce2b0e381f5c3795734ccd037fa5f49f9bcc1edda09a52b7140a25bf6b0d
MD5 7d51cec8d2b4d9c5e08f9260839d4883
SHA1 b7372071f75b91c9a1f4c1980970fcd6ef404fa9
SHA512 5800fa7543b0efe2023a902c96abd27951e58c78b2d8c7fcaed820eb1f81a67caaf3797182876fd5832d8ff7447dcf377f35320d9c6a254bf2ba36624975eea9
SSDEEP 12288:3O4rfItL8HPC1R4RqiMUNcIk8l6kW6rjTK7rKxUYXhW:3O4rQtGPMRriX+8lHk3KxUYXhW
TLSH
T1B1B4E12976818133D29202315BDADAE6B63EB4B10726D4C337D8427D1F61AE1D73A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5404	FE84.tmp

Executes dropped EXE 1 IoCs

pid	Process
5404	FE84.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FE84.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 5404	4568	2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\FE84.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE84.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe 40F3133A9AAE2BF334813051D564EDE5385C8077F961AD15EB27E9AE53D705D37EE0CA962BC54767F9A16D6142DC82BE98DA5192299582DA16B62E96F8CF7017
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FE84.tmp

Path C:\Users\Admin\AppData\Local\Temp\FE84.tmp
Size 486KB
SHA256 af4590ab40b0f636bcb601c18d6f5757ae157681eb4d15ff5893c96d2edae176
MD5 74a963d48315bc880f27beda09abf428
SHA1 a03b719025df3a41e38f67c1ad2c2fa5d41cb5a4
SHA512 a16def93de1c2dd6bbcb48a969bbe8e55ac7120593ee6c0e7af8c0513bd20556744d28ec9f4374d24e8b9b85ae81aa32d7e59e475a38c5e35e2bb9640d39c901
SSDEEP 12288:3O4rfItL8HPT+fsLsfXVK+28JrMxj3IQbLr9Vl7rKxUYXhW:3O4rQtGPTzeXVK+2/1vvl3KxUYXhW
TLSH
T13CB4F12AB6418233D19302750BEADAD6BB3E79750726E4C337D8027D1E71AE1D736346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download