872bd3f07a475464c8ff493aa0a50ba707bb453d5899e51dd47daa56c2c1ab52

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_0f0be3c4103e54607a6073bbdac9a1f0_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260507-lvtefaaz7s
SHA256 872bd3f07a475464c8ff493aa0a50ba707bb453d5899e51dd47daa56c2c1ab52
MD5 0f0be3c4103e54607a6073bbdac9a1f0
SHA1 a873a3221035fe0395d30c2df3231a8ac09bc708
SHA512 096fbdc2843e00888d07c577dd4c2645ab552666022fe11b263bb2ab1dbdffaa4a042357543fc309ee439d1b90fff845bdc6f1662252fdd24a2c5635a3923fe9
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn4zq2+sIxKylYDQVHWZFiNhj0LN5buKeLqqyuTB:U6PCrIc9kph5MqiD6YaXRENve5voad
TLSH
T13394E0343681C136E1A305318AEAD766593E7D310B22A9D77BD46B6E6E707D0EB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4620	1CE9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4620	1CE9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_0f0be3c4103e54607a6073bbdac9a1f0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1CE9.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4620	1CE9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4620	4756	2026-05-07_0f0be3c4103e54607a6073bbdac9a1f0_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-07_0f0be3c4103e54607a6073bbdac9a1f0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_0f0be3c4103e54607a6073bbdac9a1f0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\1CE9.tmp
  "C:\Users\Admin\AppData\Local\Temp\1CE9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-07_0f0be3c4103e54607a6073bbdac9a1f0_elex_mafia_stealc_tofsee.exe B3D31F331822EA0065E73BB98EDB1431290DE7A6FDBF76D416ACAAA175793A121693DCBE3476FA024A14FD244DA8331E2013A8F276791F35A280874BB9FC3BCD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1CE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CE9.tmp
Size 412KB
SHA256 47254489946705b2a51c429955354e37690e558b6a9d1d994b9866fa1a6ce362
MD5 23b9163f2a9a45a05c25333c3145cf6a
SHA1 9006d433100ca9c7b8620fd7922b9c46ed3db5b4
SHA512 b8e3e7054f99bc1cc652692e94d2a6ababd0444d2aa237bfc544147529125d37de1bdbe7cbefa0aee371610fffefc4254b22d87b93999c07e6838ef587547c1c
SSDEEP 12288:U6PCrIc9kph5ZnxvZqzQ6ufnFX6foVGl3:U6QIcOh5ZnPXMo
TLSH
T19A94E1343580C036E2D306318AEACB66693E7EB54B62A4D77BD067AD2E702D1E734317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads