907a8b58244a441f9c08c93381e2f135450068bc6a55cb644dc727799243762a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260425-c1mdmscy2v
SHA256 907a8b58244a441f9c08c93381e2f135450068bc6a55cb644dc727799243762a
MD5 a359ccda2faabf035c4339d2f78b04d5
SHA1 9856ac184c3471a605d8a82ebcc648c6e6a5eba5
SHA512 097d4b7d0cc2595814cf71d84b25051f18f4163f544a5a0257c2ed8f0332b8d05bf75bba54fec25abd0bf180ab631e3ca9c2d5b01779a117d8eb3114ae06447b
SSDEEP 12288:aO4rfItL8HRH7/pDnjo/qGpXG+lmrqT77K9wlsDpVFd:aO4rQtGRH7tkqGF/meT7+9wlsDpVFd
TLSH
T17AA4F02A7685C133D29301755BE6DBAAB63E78B41726A4C33BD4026D2F617E0D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3876	179A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3876	179A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3876	4296	2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\179A.tmp
  "C:\Users\Admin\AppData\Local\Temp\179A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe 45A405CD3F29F89A541A0F0AACBDA4084166FAA04F8091EA8120E86822C1017FF62AD42E2124076873E99D780C1B9532936D5F78003DA3086189831B5BA7CD22
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

179A.tmp

Path C:\Users\Admin\AppData\Local\Temp\179A.tmp
Size 476KB
SHA256 e5ba564b2a3564d19eb581515e0285b19f8d53699f6d588a32266963340e41ee
MD5 9e3ba551ee4697499fa5ecba860f3570
SHA1 3256a6a698c8db41a878275724ceb414b292a420
SHA512 c4f99baf921ac7f9e60015d639aac27d9c4771535db446bad497899c268f2066de25ef88ba5fe449bcc1f553872ad9ca3f4c55cd03bc233d4dd87bb5b131eb86
SSDEEP 12288:aO4rfItL8HRnsargkA0JmMWX6QFJku5F7yx7K9wlsDpVFd:aO4rQtGRnsUgkh86Cku50x+9wlsDpVFd
TLSH
T190A4F12A7782C133D2A302341BDADBE6663E78701736A4C37BD4026D2E656E1D77934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download