e90723fc80df835dcada3779fb751defee0aa4af96fd6a0a3f96cff397bf6b86

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260425-ctr1jscv8t
SHA256 e90723fc80df835dcada3779fb751defee0aa4af96fd6a0a3f96cff397bf6b86
MD5 3b262b135faacd3c6bd92337fff28022
SHA1 1412ceadacca0fb7a1a226e3ae1ac841823f2588
SHA512 687e98f3d23889986755bbcc7684957cfdbe5a7a5492b3421772ac39d3103968f44ecbb57cd85344118d366e372ff7ca4e3e53c96e7a7dc2262330260fd99c6c
SSDEEP 12288:Z594+AcL4tBekiuKzEr5OKTr23ISbbSawWrsFaNA7Ifl:BL4tBekiuVr5UZfSjWIF0
TLSH
T1A994F1353581C033E29622344BF6CB6A197E79A24B2678CB3BD41B6E5E643D2E735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2916	F9F0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2916	F9F0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9F0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2916	4592	2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\F9F0.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9F0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe DAE44610B63825828967127B85FBC5AF2701434E9477C64AC23FECA8A4947E61BAEDC98D27323A6951B30563B7C027C95ADF51BB4063070D439A545F0E228928
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F9F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9F0.tmp
Size 428KB
SHA256 7350f5fc238fa9c505522e6869f1fc72cf2cf058048efb45d0adef93c8f3eb54
MD5 43e114971e3a3b82b472586795a34cf5
SHA1 c23fcad9a0aeac5d340b65a1dbc563c7b7e88ee3
SHA512 331a2dbbf173cb7036a3c6d01ff968163bcc3572993b0cdb0d8f478c4924dc482847aaef842b9e281f271f665d16bb0a8eb5aa693ba4738ec2503f0d4799e479
SSDEEP 12288:Z594+AcL4tBekiuKzErGeG8lGdMVcFdbOAXeK/boQitml:BL4tBekiuVrGvUc9viA
TLSH
T16094F0203582C037D2A716384BF5CB66597E79B94B2AA8C73FD01B7D1EA42E2D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download