2125ec44d539880358e4a84a0beeb8d9bc3742a5ebdbb91dcf6cecb5c1e38e2f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_9517c0a8d4769bcd6ebb8ef07a8a5443_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260505-dc1rssft9x
SHA256 2125ec44d539880358e4a84a0beeb8d9bc3742a5ebdbb91dcf6cecb5c1e38e2f
MD5 9517c0a8d4769bcd6ebb8ef07a8a5443
SHA1 20571e90d45df35ae684e5a6702773224acca021
SHA512 434329180d3f08eee9d6e58ca4aed58abb079bd9437165e8f156ec6e04ebd11137cda7c0f256755f9113f9af00e0101a1758bb57184de01a124243babb7de67c
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hH902h9vFFH4kSLHsKzT15c4g5Xaj1LSUPbZ:Zm48gODxbz7PfH4kGFNuXa9fZ
TLSH
T18084CF247681C032E19701314AF6E7612A3B3DB25B2568CB7BE47BAD9E713D1A73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1684	2006.tmp

Executes dropped EXE 1 IoCs

pid	Process
1684	2006.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_9517c0a8d4769bcd6ebb8ef07a8a5443_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2006.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1684	2006.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1684	2840	2026-05-05_9517c0a8d4769bcd6ebb8ef07a8a5443_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-05_9517c0a8d4769bcd6ebb8ef07a8a5443_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_9517c0a8d4769bcd6ebb8ef07a8a5443_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\2006.tmp
  "C:\Users\Admin\AppData\Local\Temp\2006.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-05_9517c0a8d4769bcd6ebb8ef07a8a5443_elex_mafia_stealc_tofsee.exe 3663B9E869E7C4BE4DE4E6BC9A9E58FE8F2369E12D2ADB7BF8004F0FCD0621A5745053687640C725B0341BCCEAADD945A9A7A259D4A339BF8BEA0F9C6FD9263F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2006.tmp

Path C:\Users\Admin\AppData\Local\Temp\2006.tmp
Size 384KB
SHA256 94e7b9bb4b7db7ed8a6f5c5951cce7e73fbcbae94da9559892e38cacfb3ee73b
MD5 8a29044a296ea2517d3b37d719d32f83
SHA1 3bc8856bfdb117056ced279c764312a2acb27c01
SHA512 995540eefe5b20690ca4979166c6133f2e45fad45750c32d71d7510a471bd329bb6f87b5f6cb41dc5f06d2fa9b91ce3d80141829eaab9ddd09d269df1e9662b1
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHFGaKYxcKl3BFbJEq3D9znc2PEl4fMjJhtRiZ:Zm48gODxbzvGaK4jeJCEl4wJh/iZ
TLSH
T17284CF28B580C036E19601314AF6EB61593B3DB68B6168D77BE47B6D9E703D1FB3420B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-5-0x00000000006F0000-0x00000000007CC000-memory.dmp

Download

memory/2840-4-0x0000000001130000-0x000000000120C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads