437bd94eb3ce09013f9d28649644603b8dbee0add54337e19e87aafa57f6e4b9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_f1c7f017cd5423fd842dddd322630435_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260511-c5k2dadx2n
SHA256 437bd94eb3ce09013f9d28649644603b8dbee0add54337e19e87aafa57f6e4b9
MD5 f1c7f017cd5423fd842dddd322630435
SHA1 f0e22da0b89f36edfaca64235f9e0e2227b10a88
SHA512 485ece73440026169b67a94a6d60a883b5a22b1ed6b5f7b1c6baccc7b9682cda55839cda71affd4107dff64158c2565034c6f0e49a9b1798e7eb454b275a0efa
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFsNpQn4mgbrWlo8ngo3Gp0qHI:gZLolhNVyE1N2nnX3K0qHI
TLSH
T15294DF24B281C036E19201308BF6EB76153A7DB19B6564CBB3D4377E1EB13D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1000	25C3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1000	25C3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_f1c7f017cd5423fd842dddd322630435_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25C3.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1000	25C3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1000	2592	2026-05-11_f1c7f017cd5423fd842dddd322630435_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-11_f1c7f017cd5423fd842dddd322630435_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_f1c7f017cd5423fd842dddd322630435_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\25C3.tmp
  "C:\Users\Admin\AppData\Local\Temp\25C3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-11_f1c7f017cd5423fd842dddd322630435_elex_mafia_stealc_tofsee.exe C43A6510654BAA0FD1206D8A4BE88202E7414D80A6EB174C9C14F71C27C525E31494EB5DEFAA603F0F450B19A338F6D6B9D1F50CC230E722E474E84B55C42C2C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\25C3.tmp
Size 411KB
SHA256 013d4a4ec51df21bdd048125b626cca91a3f7ccd4b0d89f9ca54deae850b5801
MD5 744f03107fce8470498326759fc122a3
SHA1 5bdd1f15d3365f478e0766e391a0a18d8f0dc2fd
SHA512 c2521534e5199c9c7d92095818a2d2d996c98f04fd321eda92b0bad358fe132315023c35db7b5d1c22c99724145b8f3f64ce814d4cc29942e82fc9215f1ab252
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFaljULcNJ7jLT/3TjX1n0nkie4o8/6w2a7qHI:gZLolhNVyEPNRrT7Zuo22a7qHI
TLSH
T17994CF29B6C1C036D18605308BF6E7B6193A7DB19B6164CBB3E4367E1E703D1A63931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads