3e30cd3f42d35b1d2f2699ffc55d753f92e44dfa095379483000f44350a73c1b

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe
Size 435KB
Sample260424-qdrazabv2p
SHA256 3e30cd3f42d35b1d2f2699ffc55d753f92e44dfa095379483000f44350a73c1b
MD5 820a516e7bff4b35f2f17fdb3a0b98c6
SHA1 2ec2af9ccdc3f32e5d1f9bcd024f63003f45af65
SHA512 2133ebc3ff4e8f4f7446c44cd7043640c6d1e4b4f205ae2d60cf8e64e90bfea1c96f27bafd026c26078f9ce36f691c7732e600444b4bbc0e03c2badf5cb83277
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBYmt4g8c1PYWFTiKd4GDwlmiDNZNlTU+aT+JK:9W4ufepiqKQ1mzugvrhG/7lY+J
TLSH
T1A594E0217186C03BE1A705348AF1CB6569797DB04B36A4CB3BD02BAE6F746D1DA3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4912	2268.tmp

Executes dropped EXE 1 IoCs

pid	Process
4912	2268.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2268.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4912	4780	2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\2268.tmp
  "C:\Users\Admin\AppData\Local\Temp\2268.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe E6D1D2B797AF10A8ABECD8079425412C84A80CD0A7222F8F60C832DB296CBA0B46253F963BAB18D9AA5C93F9FDC2C560BB4C5086BF960748AC812C2561EE3D11
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2268.tmp

Path C:\Users\Admin\AppData\Local\Temp\2268.tmp
Size 435KB
SHA256 1f48116f9bd45bc91faf189f50b1dda3e6dccf15de7ee9d61b50a0146c0d2011
MD5 a347347042075863bda2679b36476c52
SHA1 b871ad12cb0cfd82afe85357430008bd0d1b254c
SHA512 ad6b5feb6a57c10587f596caed84f1230b245ce50035f6d66ac08de1a9b839de1c819b2015dbc0f1c757bda1684e8df7de46f09b6062a37dc9e919e081231d73
SSDEEP 12288:9W4ufepiqKQ1mKhkn7ZwM5QVERDkbtctFOdg/J:9W4ufepiqhmfZwWCtczWA
TLSH
T1BD94E0247582C03BE1A706388AE5CBA9593A7DB44732A4C73BD037A96F742D1CB3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4780-3-0x0000000000D40000-0x0000000000D9F000-memory.dmp

Download

memory/4912-5-0x0000000000FF0000-0x000000000104F000-memory.dmp