f32e8e46d7a9d7f302928b9870d4425099b51157b90ce63a22aa89b72b78bce1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_48073774d5e0e96b50a2cb7b720adf6d_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260425-cch2babw91
SHA256 f32e8e46d7a9d7f302928b9870d4425099b51157b90ce63a22aa89b72b78bce1
MD5 48073774d5e0e96b50a2cb7b720adf6d
SHA1 63ac3a8fec41df41a51926a52b421eab4404aa48
SHA512 d8a6890712f6750e1ebcb86c876e0a34c9fb1b09a9712fa3119baf9daee8ccc201c3d2312b8a80291b2efe595ba31d1b63b6e4aa944076e0ad5e4becd1e4fba2
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHW24XHK2Pbc0iRd3I8HPPZP/tLwDq6wei4Z:Zm48gODxbzh4XHKIfUPRHtLwe6wei4Z
TLSH
T13084DF287580C032E19601354AEAEB62593F3CA24B7568D77BE47B6D9FB03D1A73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2800	4F25.tmp

Executes dropped EXE 1 IoCs

pid	Process
2800	4F25.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_48073774d5e0e96b50a2cb7b720adf6d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F25.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2800	4F25.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2800	4048	2026-04-25_48073774d5e0e96b50a2cb7b720adf6d_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-25_48073774d5e0e96b50a2cb7b720adf6d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_48073774d5e0e96b50a2cb7b720adf6d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\4F25.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F25.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-25_48073774d5e0e96b50a2cb7b720adf6d_elex_mafia_stealc_tofsee.exe 18460144761066469D88266738B5961F09F5B5430FC86C1BA107D13890AF086131081F1487111606019DA172DA51EDD2A0C96149D0842CC4E54CD2CC34B06B39
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F25.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F25.tmp
Size 384KB
SHA256 8935d8a007676c5d4adc809b5dd40b1c7d320d2b3e51c40b6e5dc0b89cb5086b
MD5 451a6233419051b9ad55ea9980f6c214
SHA1 32d490896ff532984617dd707368759695bbed16
SHA512 e49ed4924136461a853647195e2d2ca3d3def713392957a5031547b889701aea62329f4092ef872957757407c7786815ccb5ac79bfd99f97db81626b9a744e7b
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHyt9KRSXnCriFwaJl9y7qQX94KZ:Zm48gODxbzUtQ0XnCiTJl9gqauKZ
TLSH
T14A84CF247581C033E19705315BE9E7625A3B3DB28B3568C77BE47A699EB03D1A73830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4048-3-0x0000000002DF0000-0x0000000002E09000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads