51bc7479afed1bfb31ed330d4f7b51e4e220ee36c617e1e81748707e79abcb80

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260424-tmlzdses4y
SHA256 51bc7479afed1bfb31ed330d4f7b51e4e220ee36c617e1e81748707e79abcb80
MD5 50af55e2ae4c52f36a499d2bf24ce489
SHA1 f9a569725202a8c6d28195725d53da79cbf8dc6f
SHA512 45d0906b6bdc6783c990e0d5195a9adad4014deee1ad5b46bc1136f08bad01037c3525a3b14ec69e83ee28569a8afb242d210efefd556c59dda8c8dc1778dfd0
SSDEEP 12288:aO4rfItL8HRDulCe49toyzTojuNJF67K9wlsDpVFd:aO4rQtGR6lCeGt3oujF6+9wlsDpVFd
TLSH
T115A4E12676858233D2D302750BE6DBAAAA3E79751335A0C37BC4023D1F65AE1C77A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1076	17C9.tmp

Executes dropped EXE 1 IoCs

pid	Process
1076	17C9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1076	4320	2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\17C9.tmp
  "C:\Users\Admin\AppData\Local\Temp\17C9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe BD25442937CE69182A6896E717CBB3E6FE5F3DF0841220DD15FE8640D62A6CDA1ADBC01B98027E101BDBC8D4E1B5BA528980E82EE8728FC1ACB35EB35D441F9C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\17C9.tmp
Size 476KB
SHA256 0aed0b58f754e1c33d81fb9fde3c6f01ce222ca4d3f58a182a7ccfc2ce13aea6
MD5 dad5aac791c08a4b95503a391eeef07b
SHA1 ae253abf37ee95866ddcd5ad0c3efa3bf8182c31
SHA512 33f5a9a93f8ade66137b04aec241b80fa118bd5eaf2c52f67ff2cef5cb9f5588b5c7da5abcd121ead1755f6c00a6fbbca314dc47b82bd4972c15feaaa1c2258d
SSDEEP 12288:aO4rfItL8HRb7zHxw81hAlpVzGmn97K9wlsDpVFd:aO4rQtGRbHHxRhkVz3n9+9wlsDpVFd
TLSH
T1C1A4E03A7286C133D6A301714BDADBEAB63A75B10726A4C72BD4023D1F61AE1D739347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-5-0x0000000000590000-0x00000000005D5000-memory.dmp

Download

memory/4320-3-0x0000000000FF0000-0x0000000001035000-memory.dmp