eba99e8c7c16cd49be715dd75dd3135e77cd00f13ad931d5cf890dd5c420fae8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_2f0fc4280629d6b87dd79d73a482044f_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260525-capfbaas9l
SHA256 eba99e8c7c16cd49be715dd75dd3135e77cd00f13ad931d5cf890dd5c420fae8
MD5 2f0fc4280629d6b87dd79d73a482044f
SHA1 45e59c94cbc66d12d6f82aae64a8b23f0cd26a8c
SHA512 8ff6f730d22aef24e97c3685a78975e4810c50e4d7017baf93a400f9ed00c67a286ad2181b828fa66c83a8a191e8a2773f9c34270ba107d31fc223478a98c93b
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHNmH50nJ+Shf36c7phvzNvD0FMZ:Zm48gODxbzzy0JjPFvzNr0+Z
TLSH
T1FE84DF247681C032D19701314BEAEB722A3A7CB64B2568C77BE4777D9EB17C1A63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4736	D5AA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4736	D5AA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_2f0fc4280629d6b87dd79d73a482044f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5AA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4736	D5AA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4736	4908	2026-05-25_2f0fc4280629d6b87dd79d73a482044f_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-25_2f0fc4280629d6b87dd79d73a482044f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_2f0fc4280629d6b87dd79d73a482044f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\D5AA.tmp
  "C:\Users\Admin\AppData\Local\Temp\D5AA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-25_2f0fc4280629d6b87dd79d73a482044f_elex_mafia_stealc_tofsee.exe 9DE47AA153AB6B788841D830F0EF82DEEB4EAEC4C78812DE0C0B7CDFE255A17D51E9F9C34CBACD41B9C799A77E100C5EB8597C831D443B820D58FD45CC95D996
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D5AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\D5AA.tmp
Size 384KB
SHA256 29b6a1f541ed3bafdcbdd4af81c36920cff19698a3dcf011c76c3d692ae3182e
MD5 96cfe8b54396cf0b30e31c24d0219572
SHA1 f1ef0446dc16948c1595cb29f6b1838ec3473bba
SHA512 ba74c62010879d0459ff82e22fd72580707ca240e8bfb9cdf14f174d5698ad996c6a372036b3ab4c10ad6c1db20bea15144f994e60d14a41beab4ce6268952bf
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHVg27erbLNLUhm7mDg45uix2Z:Zm48gODxbzw27e3LdUhHDg4862Z
TLSH
T1DC84D0347181C036E19601314BF6EB725A3B3CA2976568D77BE836699FB03E1A73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads