0e4e51b0a2bb3c02598ca31bc3377c6d72a92e21db6b89c7eec7ddc1f93d1a2b

Analysis

max time kernel
149s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260503-prp5dshv2w
SHA256 0e4e51b0a2bb3c02598ca31bc3377c6d72a92e21db6b89c7eec7ddc1f93d1a2b
MD5 d7fe940e37d042f5e732d466a4660c54
SHA1 3edb750e011e50116da906c76845827fb2322847
SHA512 4b0cc3f10a57ed5addbd2cb1ad1d12feadcecd9c47b89e5eca7190f008a0d879a49747f2c42e44ded95d221c00c54523f80b266162b959ea6b6eae240d9c64d5
SSDEEP 12288:Nb4bZudi79LMJ1n3N1zFEaXjqnGxEe6EyLwKXA:Nb4bcdkLAtDiaFxE
TLSH
T186A4F0243582C037D2A706354BF5C776AA3E3DA14B2268C737942BAE5EB42E2D374347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5784	342A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5784	342A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	342A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 5784	4848	2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\342A.tmp
  "C:\Users\Admin\AppData\Local\Temp\342A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe ABC895B88B3019B78020D37EC098687495FE1D26C3841310AB045647D1257DCC2CB90506545BB4CB63D32CBDA18BB49B35633CCE15A311E2AC59538C50944137
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

342A.tmp

Path C:\Users\Admin\AppData\Local\Temp\342A.tmp
Size 444KB
SHA256 a762f3efb125193d5d200cf2a781d4eeb6e12e8d76499788d2794bd292eaf8ac
MD5 24de70b87c7d4c67d5e7f37b5b6f24d1
SHA1 8fe338d3faa64367309d1f70ef5867e071447cb5
SHA512 12badf63096dd995715597d171806f6a634ebfc40a8b0fa9e56b676d498b66db2bf8dfb10bddf1916c792e28e7d44959a22f70371346246228685ddc8ef1864a
SSDEEP 12288:Nb4bZudi79L9nELR/h0RODI7kj6XLvyT+/y18c2tA:Nb4bcdkLsxi7kj6XLDW8
TLSH
T197A4E0203582C033D15716384FE2D775657E79A18B2268C73BE06BAE5EB43E2E63435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download