9a60d2b383e12421205b0ae4dfbb356f64a6927ed3de20fc8a35f06c242ac6f8

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260629-e4bseset3l
SHA256 9a60d2b383e12421205b0ae4dfbb356f64a6927ed3de20fc8a35f06c242ac6f8
MD5 a133525f0730a2b9da67f50412ff9795
SHA1 05fa4d193a28f71f402c06d8150eb8b707af7d3a
SHA512 0d230311372bb233e7c42299f2292010f8efa410d46997290a5e92233893d2b62d6dc467ba1abf48c17ef89703d69692f2ab3d202adf8c3599904e209a729680
SSDEEP 12288:bO4rfItL8HAmcj+h0E/GvjjnnoWg6MpD75UO:bO4rQtGAdS3/OjjnoWg6MpVUO
TLSH
T140A4F12A76818133D29302311FE6D7A9BB3E75B10726A8C73794467D1F65AE1C33A387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4444	ADA0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4444	ADA0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADA0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4444	4520	2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\ADA0.tmp
  "C:\Users\Admin\AppData\Local\Temp\ADA0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe 342D7DBB36200BA4ADF10E7109D3C9160E84BB28D58AC9FB3679C3FDDE33BA17FA81BB6A9DAF8524485A386BDA84314F932B6D77B77EE350EDACAEC3CF514586
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\ADA0.tmp
Size 479KB
SHA256 34ecfc01a3068ed7f9a602e9bfe243873b14ec1fcf408fdb75b7bb63429c56ed
MD5 bfe0125d2328c581553a425b12ea3498
SHA1 ad9ea94cafaf78899d621311f7ac26c29d97d36f
SHA512 44d7dcbced94b7636d33b1577386c2afc2dbaf3b08435989d964873d3723def809e8066aa7dc070d32f9df0b2cffb83d09d274bf7be4b25476db1c54837b6a81
SSDEEP 6144:b9EyS4oMxIkjxcWqHtg88HARRfPsLUGMxC3XJW1iojv7fqvK//rkQNN5kRTn975R:bO4rfItL8HAkRpejTCK/rkQKRT975UO
TLSH
T19FA4F12676818133E29301B11BE6EBA97B3D79701726A4C33BD4027E1F60AE1D77634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download