7ac581a8c85f1a9458ce47e60154f5b71a76520d70b131d08498dfdb464bf2e0

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260522-rcdtxsc19r
SHA256 7ac581a8c85f1a9458ce47e60154f5b71a76520d70b131d08498dfdb464bf2e0
MD5 eaf3ec5031d9a955c204ca08634f8628
SHA1 b7ecf885bef380fa81944a8505f65f4deac35689
SHA512 d701a983b522dc031808370858cce4dca08c305e33639eaff29b48d0d7a0ca48e1d3cdf1f1fa587309025299735bea43c1b3c85a0c92ce3979bd93134bcc25ed
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHC8PYWS7PDpdFw4L/ToIB1AEB1fdlOP+Z:Zm48gODxbzI8PYWS7LBw6oquuOP+Z
TLSH
T1BD84CF3875818037E19601324AFAE7611A3B3DB6876168C77BE47B6D9FB03D1A63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3184	B1F6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3184	B1F6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B1F6.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3184	B1F6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3184	4504	2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\B1F6.tmp
  "C:\Users\Admin\AppData\Local\Temp\B1F6.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe 54D06F25D464DCEBF5B923796879C3591AC550099FACA4900303D038216FA33D530468E06F04216AA1E146272EBE0BF9E15F82CAE5CB59CE8FD27DFC0A6E5587
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B1F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1F6.tmp
Size 384KB
SHA256 551cd45f4b7d0558051bbdc26f1dee71719e66089ac99f538355b8464113d76f
MD5 7f0d2e51db2ebb807d4b884dca407ad0
SHA1 655f553259d6e02c38087d7c7c58a0be242acc8b
SHA512 9b5d26d0b823db5a4a3e133ebd5794b64cb9c3371cdff73bb23128e513cbb97eb011bc8525906c53f1c9d70a76739b44580396c39c522c190b53671c7008cfcc
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHlCctIg8tTr06hFjfP7tKTNrP0KGCUZ:Zm48gODxbzPCWIJ06hdfP7sTNrP0K5UZ
TLSH
T15684CF24B581C036D19601314BFAE7625A3B3DB69B2168C77BE43A6D9FB13D1A73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads