2999dfd99e27aaa9df3b14213317c5869de3f05e6b8057a6df47ea2fd067aadc

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_37bb19c0d76d457289b732caa5bae7f4_elex_mafia_stealc.exe
Size 435KB
Sample260426-te53asat51
SHA256 2999dfd99e27aaa9df3b14213317c5869de3f05e6b8057a6df47ea2fd067aadc
MD5 37bb19c0d76d457289b732caa5bae7f4
SHA1 b91f7981712adf3778a2eb09a637595c2075a05a
SHA512 a974d880d327bae19dc3ccac244e027e543142ca89e0fa7fd1845c4e3fe359a10fd5ebcc130596a8f907bc15b2d09d547693c5cf3b20d90da7ccf86cdd3ea8f9
SSDEEP 12288:9W4ufepiqKQ1ml1r0YDMZRALmjWpwoCX0jJ:9W4ufepiqhmvrpM4+W2oCX0j
TLSH
T1B194E0203282C037E1A705344AE5CB6A59797DB44B36A8C73BC42BAE6F742D1DB3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4624	1008.tmp

Executes dropped EXE 1 IoCs

pid	Process
4624	1008.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_37bb19c0d76d457289b732caa5bae7f4_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1008.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4624	4788	2026-04-26_37bb19c0d76d457289b732caa5bae7f4_elex_mafia_stealc.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-26_37bb19c0d76d457289b732caa5bae7f4_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_37bb19c0d76d457289b732caa5bae7f4_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\1008.tmp
  "C:\Users\Admin\AppData\Local\Temp\1008.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-26_37bb19c0d76d457289b732caa5bae7f4_elex_mafia_stealc.exe 7F3C59E6575D8C4B71E371C41006A2A416B91D583B389BA1714213E28E296BFAA22571960C1FADCEC4A2CC4F30DFBEA501B2522FE1A0EC348A1B943845C189E2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1008.tmp

Path C:\Users\Admin\AppData\Local\Temp\1008.tmp
Size 435KB
SHA256 a6f15d09df1be8762918538f42287b6cdb3a8be4a4eec42ad05cf1ccfd09566a
MD5 8a49ba58d9cc110e4b64abeeb1cb056c
SHA1 86f7e091251249608cfb4460fcfa7c23857461b9
SHA512 9c5bac7989bf527be2a99673f371ae6ebdbdb3f1f839ade29580dc526b6664440ab41203334b3481f498acd828c3565989df74dbf9309adaa3e97d917e3e457f
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBYZJHixRyZQYEWrYNaT1whaEjW1RD4e2BVJK:9W4ufepiqKQ1mAJHixYZQYGEZwYPD8J
TLSH
T11394E1213586C036E19706388BF1CB69593E7DB14B32A4C73BD42BAA6E742D1DB3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download