ade14cab8fe1e37d7ab22c9283b13572531d39a104607c7542753dad7bb503de

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_1fe0af9824e3cd95db4b7aee23866433_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260424-wxqrfagy8j
SHA256 ade14cab8fe1e37d7ab22c9283b13572531d39a104607c7542753dad7bb503de
MD5 1fe0af9824e3cd95db4b7aee23866433
SHA1 e3c1a00e4938e94298ffc92886f594fb7800db37
SHA512 cb44e1a370b006521688dd508e43f037b15bc2bac8f02a8dbc0b239df7f8cb64e9502aded27b0b52ec97fbe209d9a9910e9466a3794f3317b77c6f5916ad9664
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYarfeLxTll8N/NRKMrY62Na6Szjcudbjpc3Jw9J:fd4x+ePixnXQjXeLtoVnu/8AWG5wP
TLSH
T14594E0203582C037E2A615394BF5DBA969397DB05736A8C77BC427AE6E302C1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2104	FE46.tmp

Executes dropped EXE 1 IoCs

pid	Process
2104	FE46.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_1fe0af9824e3cd95db4b7aee23866433_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FE46.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2104	4884	2026-04-24_1fe0af9824e3cd95db4b7aee23866433_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-24_1fe0af9824e3cd95db4b7aee23866433_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_1fe0af9824e3cd95db4b7aee23866433_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\FE46.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE46.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_1fe0af9824e3cd95db4b7aee23866433_elex_mafia_stealc_tofsee.exe A5EB42DB261DB625F79DF2E66874EE73C82694740DAF84EC7064C31A7302F24C46965B7D8DA0557AAF390E2969D092D15139FA7524D29ECB9A02680B31F518E6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FE46.tmp

Path C:\Users\Admin\AppData\Local\Temp\FE46.tmp
Size 435KB
SHA256 2f592fbb8d3aafad1cf071ed67b874aa593d513f909ea798fbe28b2fe9a830e8
MD5 00c4e061ed583d6eeb3a890e90cdb358
SHA1 75c225204a24023f924de2b7506eb02630f9ebb0
SHA512 44b0de15b5ca35f5f2bca943045f4875a62b5a7f0e7cecf71c6c05606a0633f9eb0f1d1aeecfbf77ac837dc0f65b4d3b8e896a98410f4d8f04ee26f1c5c17fca
SSDEEP 12288:fd4x+ePixnXQjpIkou7Qbs2eH5C9u+mDrwP:fd4x+ePixAjpI/u7t5J+mn
TLSH
T16994E0217686C036E1E605388BF5CB6959397DB05B32A4C73BC427BA6E742C2DB3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4884-4-0x0000000000FE0000-0x0000000000FF9000-memory.dmp

Download