a9c848c9fc1a090d9d141a4ef8dc04bf473f69367a39087b1078fbce84257a3e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_3d038829059f94c6eb7e99d354b6aa84_elex_mafia_stealc_tofsee.exe
Size 448KB
Sample260424-w2n4eaft4y
SHA256 a9c848c9fc1a090d9d141a4ef8dc04bf473f69367a39087b1078fbce84257a3e
MD5 3d038829059f94c6eb7e99d354b6aa84
SHA1 9c1fd27b6342c27d6805a8a4db11ee7c257c9414
SHA512 699e5c2d368eaa700f44a4ff1e1d4a9b276f8f096ee17f69fc1e2e0b2d996483ea26b161e33349505afa694800c639927ec696f0ac965439be7b733d382498b5
SSDEEP 12288:lb4bBxdi79LnwXLleR2xQcb3QMMA7IgHA4:lb4b7dkL8MOvzQM77
TLSH
T149A4E0143181C036D26725394BE6C775A5BE39A04B21A8D73BE4EBBE5E706F6DA30307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2080	5D1F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2080	5D1F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_3d038829059f94c6eb7e99d354b6aa84_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5D1F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2080	4640	2026-04-24_3d038829059f94c6eb7e99d354b6aa84_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-24_3d038829059f94c6eb7e99d354b6aa84_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_3d038829059f94c6eb7e99d354b6aa84_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\5D1F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5D1F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_3d038829059f94c6eb7e99d354b6aa84_elex_mafia_stealc_tofsee.exe FD94F7783F6E9A6FAE689A082A8B69A26A29AE163274E67E3CD6350FA75FDC746FA6AB7897226564A534B338BA9EC4EF292F61329243AFE19A87A3F402762E7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5D1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\5D1F.tmp
Size 448KB
SHA256 fca235af58afe4cb5d6bcd4b3ef43aa2739383e27650e30b5f9596d9205cd378
MD5 1633ff84a9f7313d7b555aa4d29fab6c
SHA1 e76d9950e1a19c85321e3715ebbcd5d58a48022a
SHA512 6333a8986da479242da24803525ccc3a8b99d083cbfd9213a852340f66b748e7a293c48ccca5cea48e68108edaa79a076ae58adbf5dec9ddced7a030066f6b6f
SSDEEP 12288:lb4bBxdi79Lrm5V53wna8H6j/Ki+/KWgA4:lb4b7dkLrm57Ua8aj/Z
TLSH
T1DCA4D0203581C037E26715390AE5D736A5BE39A04B22A8C73BE4EB7F5E606E5DE30357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2080-5-0x0000000000880000-0x00000000008F9000-memory.dmp

Download

memory/2080-7-0x0000000000880000-0x00000000008F9000-memory.dmp

Download

memory/4640-0-0x0000000000310000-0x0000000000389000-memory.dmp

Download

memory/4640-6-0x0000000000310000-0x0000000000389000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads