d0d58d0b8e64af4500a46a3bd6653aba3e5f5c84d1c290e66267e27ea7e176fd

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/06/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260606-pr95kaes8v
SHA256 d0d58d0b8e64af4500a46a3bd6653aba3e5f5c84d1c290e66267e27ea7e176fd
MD5 102465aa5e79e44d2ef0787200f9bfbd
SHA1 b894146c3cf613e6c9123a9efcf29401117a6bae
SHA512 5fbc81cb238f7fa8122b6dd1b0d20bd153bbf8baa3d623bbec4ba9f01f6cdd4c839239f89109813ed820d657167eca2272b335d2959228c21b834bc687d56f31
SSDEEP 12288:bO4rfItL8HAUQX6/9YZS081y/6jg70aC9coQrkoVh75UO:bO4rQtGAdq/3ljg7/C9cSoVhVUO
TLSH
T187A4F12A7681C133D29312750BE6DBAAAB3E3975032664C33BD442BD1F61AD1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	BA3.tmp

Executes dropped EXE 1 IoCs

pid	Process
2744	BA3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BA3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2744	1576	2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\BA3.tmp
  "C:\Users\Admin\AppData\Local\Temp\BA3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe 2FE6FA4D593B5B34C358B61046C156C572C0DEF20A5B64D2CA8545F310BAED575E8F74AC2C8638B35AD37394F66B52A9C9F99EF24F0926246326B8F3CC7971C7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\BA3.tmp
Size 479KB
SHA256 b8c7ec9db47296cf089d3bd16ee201f809d6b363f727a3268fc07e621c4d397f
MD5 b1f013cba32b75a9eecc66e97cf5e46d
SHA1 8d1a2de0c342c1fac9f90f434278ca9969af3a92
SHA512 86a91102047a8cf205a4cdb61b214c40790313667f69d0babf5ccce8c98ce108c4374d4f66009faf0c7543ece9eccff6bc9dff32d77672972efe8179b8ea5ed2
SSDEEP 12288:bO4rfItL8HAXJ8ShAx/OdqA+CpLnG4y/yHY75UO:bO4rQtGAXH+/0ScjGPjVUO
TLSH
T1F4A4F13A7681C133D2A302740FE6DBA66A3E75700726A4C73BD8067D1F616E1D37A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download