4e2e04f04cb3a90aa189c78dc76376622c6063f3c910a1b79ec20187c8717f14

Analysis

max time kernel
149s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260424-twtetset31
SHA256 4e2e04f04cb3a90aa189c78dc76376622c6063f3c910a1b79ec20187c8717f14
MD5 85c8215031f3fe47145b361731ccc3e1
SHA1 5f7723e332fc0cf688fa2f2bc1a9d4095dd00e65
SHA512 9bf2b9ab06c9e8935032758929bd1d2bbef98f997b9d8e614a65d9d0c777dcfe01a24f80db677548b591709e316c5d2b236f2179867b48f49bb3d2c88cdf4680
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnaQWu4a3EV2ENGUkkkO4c++CXvKqkpC/2P:U6PCrIc9kph5DWu4a4xGUAiqGCe
TLSH
T1E694E0343181C037E19316304AE5D7A65A3A7E714B32A9DB2BD467AD2E713D1EB38347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4628	248A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4628	248A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	248A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4628	248A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4628	4808	2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\248A.tmp
  "C:\Users\Admin\AppData\Local\Temp\248A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe 839FBF4BBD8DD744B81229570172F4EB5B74356DED7526902856069C7201D69A4BD49F38D7C86A992A84F8CB22CA3ABB1130561DFA5C2A7440CE1271727C3B33
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

248A.tmp

Path C:\Users\Admin\AppData\Local\Temp\248A.tmp
Size 412KB
SHA256 b7abfa589f724db46d5fb7a0d8592687a6e18bc3082bcf1d5cdf6d50969d7727
MD5 5efadef80a8d80ac46e1149b68395095
SHA1 5a609431c7946a8a9d6ee2b7a74d4c99a9618d9e
SHA512 ab70a1c6435ba784a8a454e07ca3b0c43d515fc7781ba5562ee1013a21ed3e863b35dcffa9fbdfc6dac2151e67e68d1a8e94de5d91c9c370512161d39f73b07e
SSDEEP 12288:U6PCrIc9kph5L48ej45fT/8lufT/8/1PL7:U6QIcOh5LFejg7KufTK
TLSH
T15E94DF343581C037E29305348AE6DB6A193E7E755B26A5C73BD4A7AE1E702C1EB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads