2ac9286c21c376fb5a30e9f6b95e34af65ef9540404f9ba630b54b31982bf352

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_146a3018f28d1ddb1242940ea24bd033_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260510-l2dbssds2s
SHA256 2ac9286c21c376fb5a30e9f6b95e34af65ef9540404f9ba630b54b31982bf352
MD5 146a3018f28d1ddb1242940ea24bd033
SHA1 7347161268a89baa94733d0a830a88441cf64ba0
SHA512 727a6f9c3360c68c62c1a748530c9d257569f9d3dde8e18ba23a96e47a21f2cba1fed743fbc9434b2b10805b6f0dc77990bc64a8e40101f470c487bbba9c26cc
SSDEEP 12288:Ci4g+yU+0pAiv+9KHQ2p/5CPEvRbET94lnyn:Ci4gXn0pD+9KQ7Oqp
TLSH
T10A94F1313496C033E1971A354BE1CBA66A7E74640B26A4CB7BC41FAE6EA43D2D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4416	E2BF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4416	E2BF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-10_146a3018f28d1ddb1242940ea24bd033_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E2BF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4416	4200	2026-05-10_146a3018f28d1ddb1242940ea24bd033_elex_mafia_stealc_tofsee.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-10_146a3018f28d1ddb1242940ea24bd033_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_146a3018f28d1ddb1242940ea24bd033_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\E2BF.tmp
  "C:\Users\Admin\AppData\Local\Temp\E2BF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-10_146a3018f28d1ddb1242940ea24bd033_elex_mafia_stealc_tofsee.exe 2DBF53D5453596259901F1693E9B75B9BC5A8716848A549197A60AFD5F3F1CD5CF6B3DEFC74C40B554C70BA3C1847706A378287518051205B6FB7C4ECC2F0E7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\E2BF.tmp
Size 433KB
SHA256 f3435705b8332c63a20eaa5bb6e3e230ee3d21117d32c3409c4cdf2a2f45cb21
MD5 6c5cc43435c35d3ffa2f1c67fea56239
SHA1 c7770656312f48fdbc00ec280b2f24fda9a27d1b
SHA512 670fceacd9239fa7ba7c13fc2c20ea01385c1986d1cbd768d7f6d286b58cd2c1f986b3a13afc0135406209aaf0604d7df235af58bd1cff5c0cf79b4b5c62860d
SSDEEP 12288:Ci4g+yU+0pAiv+csIkTFViWCMaMh4MSSYYQZY2Gf3n:Ci4gXn0pD+N7F1aW4MvHQZrGfX
TLSH
T14294F1303692C033D19A19354BF5DBA62A7D38A54725A4CB7BD01BAE1F643C2E73830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4200-4-0x00000000006A0000-0x00000000006FF000-memory.dmp

Download

memory/4416-5-0x00000000007A0000-0x00000000007FF000-memory.dmp