e1c7e761598404ddc912795bb3a3a505aa5698c84cfe8d3b26e5eb763a05c361

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260426-e5fsrsfw8p
SHA256 e1c7e761598404ddc912795bb3a3a505aa5698c84cfe8d3b26e5eb763a05c361
MD5 300b67955642b6a9e27b6aae3bcd8cce
SHA1 7675d0511d4ba43a43d62c66878e2c222032ab1d
SHA512 1e27505ccefeb533d5895efca2a89e28cc174919ae50b747c06ca6b39bb6f1e488ff410047bbb2518ba34631f1056f359544db3313408656b8c68bbbb9bd066a
SSDEEP 12288:fd4x+ePixnXQjBMQJPGM50RvoBJV1RTnS7DYwP:fd4x+ePixAjBLGawvoBJV1ZnQU
TLSH
T18994E0243282C037E1A206388BF5CE6969797DA40B76B4C777D437AA6E742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4392	6A2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4392	6A2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4392	4348	2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\6A2.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe 85E69E573F56654AB39949C3FBEB1087301164697C051B6E63B3B1C31091B32C7515E425EC2673120F7C04C21B9C31216E72BE50F6D26F2CD6724268E5611722
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A2.tmp
Size 435KB
SHA256 8b388e709388101563874c52f0da42c6c677b9930028f92ac14cae905f26710b
MD5 615fdf0800ef77296149fd49e81efcff
SHA1 ab71a69cad954b855f9edb258a3dfac7d81e57ff
SHA512 6eb26d394661073a21847b6bfb2c7d9caa6ed83dbd57b3e7f3f1f880a923c87845c1793736febb6e2a88ff2bd48055d98d33235f863b0dc31abb241fecad33bc
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYRx3j60h7E/RbpA0WjY6U7SF5pPEIHyqeqlLcNg:fd4x+ePixnXQj4j7CrKYtw8qZI60wP
TLSH
T1FA94E0207686C037E2A716348BE18AA9597E7D604B35B8C737D42BAE5F742D1DB3034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-4-0x0000000000800000-0x0000000000819000-memory.dmp

Download