63dfea9bbfab29e2079d2c13f858f034e64518a96fb7a7002559d45deb7f467f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_cd396561ce9bf32c7ca7468460beaa73_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260509-d2qccsat2t
SHA256 63dfea9bbfab29e2079d2c13f858f034e64518a96fb7a7002559d45deb7f467f
MD5 cd396561ce9bf32c7ca7468460beaa73
SHA1 a1d05d756d876977c8d3368086441393044cc72c
SHA512 c60902a57889bf94a4777a9d089473c00e8a17453fd5914f08a5a1023ffefb8251cfe0294aaa0301feaade2635936c4591b30a41a5e67f45c7678785c644d5d5
SSDEEP 12288:aO4rfItL8HRNqYSkpNsYaivmVuMzMrl7K9wlsDpVFd:aO4rQtGRNqYFTvmVyrl+9wlsDpVFd
TLSH
T133A4E12676818133D29311701FEADBD6A63E79B11766A4C33BD8027E1F61AE1D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4680	2D93.tmp

Executes dropped EXE 1 IoCs

pid	Process
4680	2D93.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_cd396561ce9bf32c7ca7468460beaa73_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D93.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4680	4696	2026-05-09_cd396561ce9bf32c7ca7468460beaa73_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-09_cd396561ce9bf32c7ca7468460beaa73_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_cd396561ce9bf32c7ca7468460beaa73_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\2D93.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D93.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-09_cd396561ce9bf32c7ca7468460beaa73_elex_mafia_stealc_tofsee.exe F23E9686F2EE6802D67F7E3D34726E00A17660FAF8DC0E2E282FEA3BFE526B47CD892E1C6993B885248479987BDE4C75D819F703AAF8ABE6E29BFEE0C3E12D3A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D93.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D93.tmp
Size 476KB
SHA256 26161c2579cc2ffde7d9bdedece75c1abd8a82d7aa848aaceefc3b4a86f8343d
MD5 9fc7024925a15620df6490cbd3a243e3
SHA1 41df51aa836e130706c9c5f1fcd687513c819222
SHA512 60d0393384fa968eb67166f6495f2a7576d5491b4c58a76f67a155479d6edd0038de339b4c24a44e20d3ccd9697fcfef3a3529125a8ddce7932aaa486a701172
SSDEEP 12288:aO4rfItL8HR0sv9/hM0InhYWr3zCvc7K9wlsDpVFd:aO4rQtGRXdht5WD/+9wlsDpVFd
TLSH
T149A4F13A76818133D2D301755BE6DBAA663E78750725A8C33BD4037E1F60AE1D73638A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download