6f84808a9626cb3b57410cef8c7d1918a315185e1ec6b0b42629d7fc780de131

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260425-bcferagv5l
SHA256 6f84808a9626cb3b57410cef8c7d1918a315185e1ec6b0b42629d7fc780de131
MD5 00543e52d8acc42b0e82e731b5c51a46
SHA1 8df26e172871df7a07827fabac4ab5f214050fd2
SHA512 da42faae9bbb091fb59748f418beebccf5768727edc051370424542e87f1b2aa4ef10014b35097c3897aa2e53859090ca21b7af2bda9f7c7788f0157592d6491
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHCal1uvPS1vvmXy9+r5P8d495mz/YfjZ:Zm48gODxbz4aXmg3mC9+r2dT0fjZ
TLSH
T15B84DF247581C036E19701314AFAEB625A3B3DB64B6068C73BE07BAD9EB53D1E735207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
812	635.tmp

Executes dropped EXE 1 IoCs

pid	Process
812	635.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	635.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
812	635.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 812	4976	2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\635.tmp
  "C:\Users\Admin\AppData\Local\Temp\635.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe 9ECDA80881485FA31CA1C6FC3EE463E332880462BFD7849C863F7A782794476F2F4A4EB9B0A369253832DDFA33A59BD7A9A1EA9B67164463FEE151100A070C80
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

635.tmp

Path C:\Users\Admin\AppData\Local\Temp\635.tmp
Size 384KB
SHA256 96df76237b75e9d806168b87f986b78ae963528bf09c1c8602efcc3d187714ab
MD5 198a7bdbb5856196c471ee9982a3055f
SHA1 58c52d35ef6269b7c6941aecd8c73487bdb84bf5
SHA512 f7d19cf5629f07a79d94220513d1340c067f1658269c66f32fba55f21819e6c1d177a130b9baf9713ee3eb9522a25be448b27b3be5634ee39964cad4ab3e23cc
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHwPix2GY9q5uzAzSLQJaWpGdZ:Zm48gODxbzyK4GY9q5YQkWMZ
TLSH
T1D384CF347581C036E19B01314AE6EB651A3B3DB64B2568C77BE07B6D9EB03D1A73930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4976-4-0x0000000000F90000-0x0000000000FA9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads