df42688bc2e69a2076ebf06cee389c0a508b21cffcb9d081be7e532c1c51661e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260425-d94vqaev7y
SHA256 df42688bc2e69a2076ebf06cee389c0a508b21cffcb9d081be7e532c1c51661e
MD5 be1e3d6a19a0670291069a0593cfc270
SHA1 0e77c155e9475f8d1f7d611a1dd2c45b1c9478be
SHA512 40536846c31047da06d20e3d0e120a55829669f43eb8786a64b41e37ba27ecf2254decff3644dfe46bb7b559fdee3c1c42655906145b811526d29a6c0d8ab9cd
SSDEEP 12288:qO4rfItL8HG7rx9jAJ5TM2yvwgsXV3Z7bWmeEVGL:qO4rQtGG7rXjA/XCwgsXV3ZumeEVGL
TLSH
T187A4F13A7241C133E29301711BE6D76AAA3E79B50726A4C33BD8067D2F616E1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5372	589.tmp

Executes dropped EXE 1 IoCs

pid	Process
5372	589.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	589.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5372	4148	2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\589.tmp
  "C:\Users\Admin\AppData\Local\Temp\589.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe 894F5A21527AF3D2E238191987692E541D1FBC0736A3D72BD0320CE55CCB71E8FE0A9F1396850D2DCEFBBC412161646F53BB62E3576A2192B33DDCBA564345E7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

589.tmp

Path C:\Users\Admin\AppData\Local\Temp\589.tmp
Size 468KB
SHA256 f4f7ca601d597107b33b5d02c1c7d8876229975d5046d9b5d0921f08175dd19d
MD5 bb69b2659b48f71f6d568866a0e002ab
SHA1 ebb2065c30542b6718476f43919b58d3adc24e68
SHA512 a202e0137a85413695bbb5b8e66a9e944df20db97849be2ee47f4769baa963baedd9ae0f3b626fb8ac3db5ac8df8002c43bd9dfc0e25d37c253b8b3e58f29cea
SSDEEP 12288:qO4rfItL8HGkBpsSzX0vSBdIzUwyKWtNK7clPIUp7bWmeEVGL:qO4rQtGG2RzEvSBsKtNK7clpumeEVGL
TLSH
T1D2A4F039B282C133D29312750BEAD7A6A63E75B44326A4C37BD4037D1F656E2D33A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-5-0x0000000000C60000-0x0000000000C79000-memory.dmp

Download

memory/4148-3-0x0000000000BE0000-0x0000000000C5B000-memory.dmp

Download

memory/5372-6-0x00000000014F0000-0x000000000156B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads