a46159d5a168a5ed1434bdf3377d629a06ff4d0f8bb045ce53f58d4583f17d60

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260503-k3ltwset8x
SHA256 a46159d5a168a5ed1434bdf3377d629a06ff4d0f8bb045ce53f58d4583f17d60
MD5 9db23b8e55d34098abccfd12838b1b26
SHA1 f628dc009c9ca5f920bde833e1a4ce1d5a587eb4
SHA512 209b36cd80f77ec1bdffc6a8bbe1fd98bd9c961a8a43f1b449324adc32649a9d4e5294586cefcae75b71639140f2d87408da3180a7696aebcf1b5cf48fe64c7d
SSDEEP 12288:Nb4bZudi79LrCZK1FQAA239pNKa4+6TZZKIA0a:Nb4bcdkLrCZ2ywtpUaZ6C7
TLSH
T19DA4E1243692C037D15616394AE6C7B5667A7CA19F72A8C73BD03BBD2EB02D1E630347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1392	3FA4.tmp

Executes dropped EXE 1 IoCs

pid	Process
1392	3FA4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3FA4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1392	4484	2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\3FA4.tmp
  "C:\Users\Admin\AppData\Local\Temp\3FA4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe 1C1CD6DF693A468ACD0A661AFE6CB3F77D89B7A2F915022C6D33443EC0BD7DC35A74A1159BA505900163AAF02512CC7405101CF72F85E7EBD7760A6E2AB29524
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\3FA4.tmp
Size 473KB
SHA256 3cca44c5a7dcbd20ed7f5bb18ba4f9c25fb1e38766ffcedbf1744ecdea137002
MD5 4d2f516664901bac204c62e2a115ef2f
SHA1 a51c0ff20c10aabfc3fb7f9bf35abd7789ce8997
SHA512 7aa7d6728d0830b74bc5b0f2234a9747fc11b6b883480f62c499a088a082a60d485247c09a8342ea4acfe4ee36559b3ea5b8fd64e6f4d13cee505a544790b46d
SSDEEP 12288:Nb4bZudi79LISoRQ5gGEpkdEz4pxTg1+a4eA0a:Nb4bcdkL7oKFkmgM9
TLSH
T1A6A4E0243582C037E2AB05394AE6C7A6657E3DA15F3168CB3B9437AD2EB07E1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download