ae1600e02f77049497cd701e9b259e17d3f2a74b976c3166ff43ecb7c0184fb0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260425-bvb52saz4s
SHA256 ae1600e02f77049497cd701e9b259e17d3f2a74b976c3166ff43ecb7c0184fb0
MD5 22ee6d4d79eb0fe4f4fd76e0172e4dbc
SHA1 318c2b9f91cc96da03b0d65c305828d4470fa150
SHA512 301a435de24bccdb9a014af0a3d46e9262f4efe03ff8df97352e377001af2ffbab7c6a3a34f25809c05028b72610d5c7d0d65706b0adfa620e82bb8ca80eaf56
SSDEEP 12288:Nb4bZudi79L5omixJrX6WR3URDWIuR+KWiCoT3PcEYkEA0a:Nb4bcdkLizj5qAjj3P7
TLSH
T10FA4E1243581C037E2A705394AE6C7F5563A3DA19F22A9D73BD03B6E6EB02E1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4816	270B.tmp

Executes dropped EXE 1 IoCs

pid	Process
4816	270B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	270B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4816	4796	2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\270B.tmp
  "C:\Users\Admin\AppData\Local\Temp\270B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe C0D0AD76B4F25830B8D619D019796604AA8E1334F07D9FC8A41F0961EDCE355608422CEE2808E7C7207D06174EB3415B1F6ECEC4070496E82955D84980607155
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

270B.tmp

Path C:\Users\Admin\AppData\Local\Temp\270B.tmp
Size 473KB
SHA256 33b060b8f471c7a0b4c2bccecc46494b3bc48b5412895ade96ff4a1f44ec5106
MD5 1c18eef3ae456e5d2ec8e8a9af6ade6e
SHA1 11000c4ed67814ec518e6143dbc1b9feb2aa3fc7
SHA512 2cc10e4854985062888895972da13d64d27c4be3e3c0562b9d9908665d7773cdfc90b57805f759df37ce0902611cfbcb85ee0427c83188b79a3dcaeab31c4240
SSDEEP 12288:Nb4bZudi79LCOPEq+DFyPE9/hv2mfh7/gXirA0a:Nb4bcdkLdExQiJvp7/gXiu
TLSH
T1DFA4E0243682C037E29706350AE6C7B5657E7DA05F71A4C73B903BAD2EB46E2DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download