0d702ce11227a4196592cb801438e12729aecfd5294b9b347c96f2122783dffc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260425-b2vkzagz2p
SHA256 0d702ce11227a4196592cb801438e12729aecfd5294b9b347c96f2122783dffc
MD5 34a7890114c7ce8634fbda9c397d5fdc
SHA1 2a753a1fa1e5b16e3084e8a7c11213ce8901c6af
SHA512 d626d67ccd1df6be8f13242136241824e2fc68f546907d7faee709012d7c334f49cab381ad13bd0380b215f3db4707c1ef29c2d19ba3d70c6ba669522f492536
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvU1wV1Ak3QDwaYo66wsadEajMr5l1QY0KjJP:Ci4g+yU+0pAiv+Wuc8aYogILQY0CJ/n
TLSH
T19F94F1303586C033E29716348BE9C766267E79A21B2668CB3BD41BBD2E603D1E774357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4452	8B5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4452	8B5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4452	4508	2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\8B5.tmp
  "C:\Users\Admin\AppData\Local\Temp\8B5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe D6C68167F3D150ED966571DA585A1FCF02F87B8689F025332A04DD2F4574A241033FC639B10C037E13135910BC0B8E7E8D775FB45F3DCA0826DD7EFD7EDCC723
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B5.tmp
Size 433KB
SHA256 6b788aa440047259b49300a78b60581fd24d35e34464fe265f857839746d8cc6
MD5 b93147b352f35a94d938b1481c1c3efd
SHA1 0840b869b41ecc2aa90460e8059282a0f388d289
SHA512 ce3c2fb5dd86bddc1aec4c2d433cd4cfa1569ca648fc1c1dc19c89640b9649e51db14c40d95ff10419546a03636f5f7df266dcbb7a86be40eb919eaf24fe583b
SSDEEP 12288:Ci4g+yU+0pAiv+oWio57YNRqaNzVnawbapXn:Ci4gXn0pD+oLhNRJNzAwu
TLSH
T13E94F1213592C033E1AB15744BF5DB6A257A79B10B26ACCB3BD44B7E2E603C2D63435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download