1ecc37ae3b46ac14d3e1abeb58ba6af4551a55d2c62832984489910ca08938ae

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260504-bthlfaaz7s
SHA256 1ecc37ae3b46ac14d3e1abeb58ba6af4551a55d2c62832984489910ca08938ae
MD5 00b72ae810050df99eeef65c42a2a24d
SHA1 f6d735f1e6cd8b8dce47c249f5698c047c6c43ba
SHA512 4a6267c696ce47fbe1403e4bbed3ae93da89788227f1a11c30284f07d5da6d6a4756fe333ff9e90a456d29bc393e539774f2efae14335cadd80cbf099f26448d
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYDxrNt+qbcTnhBv6NklaJG23mHT7ANxel:Wq4w/ekieZgU6A7+qbcTnDSWINxel
TLSH
T11794E0303681C037E1A715348AE5CB6A297EBD744B36A4C73BD02BAA6E742D1D73531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4924	376.tmp

Executes dropped EXE 1 IoCs

pid	Process
4924	376.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	376.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4924	4760	2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\376.tmp
  "C:\Users\Admin\AppData\Local\Temp\376.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe A935F8D632E302C87D0964056EEA4593DDF1FB470263E4845E556B5C2A95AA68BA166F6F39CAA207920CF6B65569574679AEA87EF6A359D16598E0C69C9D9DB8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

376.tmp

Path C:\Users\Admin\AppData\Local\Temp\376.tmp
Size 414KB
SHA256 14987268b5a6c39dd52de84c3880e4b2b69a6baabbf1d84247cb1e4eb43987ea
MD5 1fdbe75a0e476a1d2edda80587355e72
SHA1 34ef253a1643904f1ae371ee5af38b83e12ff6cf
SHA512 daa73a9805ea428152a6826feaf71029d77c47b93e2f59f87af2740c75fed7a15dfc8bfa86400e89748172a2320126cc18edf5c0296782a5866f4e84f6053eaa
SSDEEP 12288:Wq4w/ekieZgU6vveZYOOk7a0cUYlgz9+Z7Fl:Wq4w/ekieH63eZok7anlgz9M
TLSH
T11894E0217686C036E26716344AE1DB79693EBD604B36B8C73BD42BAE5E741C2DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download