4f4ffb22f0b037b49f2f4e0764e57a67d5bd06285f46a4f5c094a6d5bf7915f0

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260511-exs35abs4z
SHA256 4f4ffb22f0b037b49f2f4e0764e57a67d5bd06285f46a4f5c094a6d5bf7915f0
MD5 9c5eafc66530aaf59bf4b70ea936301f
SHA1 df7ff17bcff811ea1fb257d3f488ee60a3fc4df9
SHA512 cc64021a36f73c0477aa3e219a2ca7c1cc84b3c9e3bb871d95e93b1d02d41b31169e82e3399e84d699d702e73a23fac49a831294f85f09010d678a9246a3d379
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStO7bE+rUtTQQX6UCKw2lV8UvvszbVNo8CGc6:Nb4bZudi79LITp6p2lV8U3Apc0kPvBA
TLSH
T111A4F1207581C037E29716384FE5D7B5657E39A24B26A8C73BE05BAE1EB02E1E734317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2904	567C.tmp

Executes dropped EXE 1 IoCs

pid	Process
2904	567C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	567C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2904	2716	2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\567C.tmp
  "C:\Users\Admin\AppData\Local\Temp\567C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe 2EE6DE095CAC5244D72ACB70168FF3005035D8CB06A5802D6E09348642F079A68F4BAFE4665B4F707C4372A27462543FE695C783F3320DFFD9E8D1D82A534F47
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

567C.tmp

Path C:\Users\Admin\AppData\Local\Temp\567C.tmp
Size 444KB
SHA256 a22c7121ac43bb12d6ffcbe7115b7d2cca32abf4202d17247b58e98c62c6fa60
MD5 1da1315d89e91a117314e380accc0268
SHA1 6dc0f77a28cf3e85a0293f8ea54d3b3a0c8a64b5
SHA512 5df15b14d2340dab828a78929c475bb2e6b7401e73827923b9d32549af1f84f6245df7b0f9ff1f6ccccb726c5406a0698f8c526bc864ea3417dffc3ae39bc233
SSDEEP 12288:Nb4bZudi79LJZRhzG2entl0tRKTajFAzf0FnPBDeAA:Nb4bcdkLJbhzDAj0RPBDe
TLSH
T162A4E0243585C037E29715384BE6CB35653E7DA14B2268C73BD06BBE6EB02E2E635347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download