020e79e2f11a5189dab902383e38296f7094df1fb4d8c7b976f3291d7df62323

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_af11b50122bb04d361ebeca95d4dd612_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260628-ykawkadw7l
SHA256 020e79e2f11a5189dab902383e38296f7094df1fb4d8c7b976f3291d7df62323
MD5 af11b50122bb04d361ebeca95d4dd612
SHA1 e00571d7090bf3cb815cbab9085e1d6b885dd67d
SHA512 3d6727e7fd5ff5aeac993d22588d058a8155bb46fd8f277a935d982e44dd45d0b01b6b047ffb73c4710dc379a3ac00c5e59c9aa3fd97fb159743dd2460555012
SSDEEP 12288:3O4rfItL8HPU5kStA4aiIkLdIYwWNgk7rKxUYXhW:3O4rQtGPU5kStA4aidjwbk3KxUYXhW
TLSH
T173B4F12AB7418233D29302751BE6DBEAB73E75B1032694C33B94027D1E61BE1D37934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4420	15C5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4420	15C5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_af11b50122bb04d361ebeca95d4dd612_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15C5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 4420	2592	2026-06-28_af11b50122bb04d361ebeca95d4dd612_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-28_af11b50122bb04d361ebeca95d4dd612_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_af11b50122bb04d361ebeca95d4dd612_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\15C5.tmp
  "C:\Users\Admin\AppData\Local\Temp\15C5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_af11b50122bb04d361ebeca95d4dd612_elex_mafia_stealc_tofsee.exe F06BBC0EB4F8DB270746E7A689EED1E2DDA03FD4BEF04008718277B8B3E3262277534D566E938570C9629C611A8C1F8B238B9137CA4D2C489A0BCA5E1277D892
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\15C5.tmp
Size 486KB
SHA256 6258995a2bebed200b157e527a199267cf41b46b952593842e633701239d5ddc
MD5 691a847c970574e34e46e18a59b17e4d
SHA1 908f6885f4743af78d12ca5e7a8dd36cc0ee8630
SHA512 153b53db4385fdef8779f76a099d0ea392c44cdd8c6f6f1d98e6a730e485f7d9e27ec62601352826ffe19275be90c92e56d838d1d51f3c7995a6db7a1c4d2d9d
SSDEEP 12288:3O4rfItL8HPLqd+oMJkPN8UrDzSwIuHVh9+s7rKxUYXhW:3O4rQtGPLk+XJkO+ZHL9z3KxUYXhW
TLSH
T13CB4E12A76818233D2D202311BE6DFDAA73E75B15332A5C37B94026D1F616E1D37A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download