e8236b93064551d338d14808d2e594dacf7f23f8055e0baaccd2783015787431

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260425-ctfbracv7s
SHA256 e8236b93064551d338d14808d2e594dacf7f23f8055e0baaccd2783015787431
MD5 67fabb78d4664bca826ab8de707ed021
SHA1 46d61a29d176c1c9ac52f209e665ac3e3842b2d8
SHA512 88c6b50774bfa2e0adf4ed0e47fe9d81f8262358eb5ec48b953676372e9558adcf8d2383f0d5399c7f66b38ffa30871d4e8c32ef481696b0bc0455db6ce493cd
SSDEEP 12288:bO4rfItL8HAH+Uaf5EBfqGhkZs6XSWf875UO:bO4rQtGAHrahEAfZAVUO
TLSH
T19AA4F1397681C133D29302754BEADBA9B63E75714736A4C36B94027D2F61AE1C33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3480	7EA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3480	7EA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7EA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3480	3088	2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\7EA.tmp
  "C:\Users\Admin\AppData\Local\Temp\7EA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe BD2AE1BD5FDF1E04EE8A20C5246337ECD16F72C85C3B06C6C03CCDA856B7C1FA6C6A3E423B00AEE6E4023C7564F9CC9FA6381F0CC270EB11ACF35D9790EFD0A8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\7EA.tmp
Size 479KB
SHA256 9cb2b3e73fd7c05ec9a6e20825ad434b57c78af29a097cb82ea455f72cc137e2
MD5 56ddf1a877bbbb0e037d653003fe5936
SHA1 db27dca26fa18af8548862ac46899ca18cb1a8ad
SHA512 eac2800499abd684804cfb030e6190487bbf354f58c1e6cb696d6013d3db3a03c2683665a7e34884da26b9a4b29020f4e16d8233ff0299d769b6d7ad49cca430
SSDEEP 12288:bO4rfItL8HAwAvPTJKwylbM3cAVzd75UO:bO4rQtGAwAvElbMMAVZVUO
TLSH
T18EA4F129B341C133D29302750BE697A9B63E39B15336A4C77BE4026D1FA16E1E37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download