08877e9e29ab773f1b9038256e920d1ec8bc623d676febab617ee15d6f924a5c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9e1e2866df80de4d3afa3838349f9b8c_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260629-e7zcwset8j
SHA256 08877e9e29ab773f1b9038256e920d1ec8bc623d676febab617ee15d6f924a5c
MD5 9e1e2866df80de4d3afa3838349f9b8c
SHA1 1270fff1448273f1881808a167c0815beaa39a6d
SHA512 9701e2c78863bca6e7f5129068ef91315b8eea55d8a6cb475dd9a9c291bf6eff715849a79676e6ca8151107cd2a50613297d15df9c440365229d9108bf31a780
SSDEEP 12288:3O4rfItL8HPSeuSenDGIcPYyJZ7Q7rKxUYXhW:3O4rQtGP4SscPTJZc3KxUYXhW
TLSH
T15FB4F129B2808233D2C301751BD7DBDAB63E79B51366A4C33BD8427D1E61AD1D37A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1784	41B7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1784	41B7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_9e1e2866df80de4d3afa3838349f9b8c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41B7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1784	1548	2026-06-27_9e1e2866df80de4d3afa3838349f9b8c_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e1e2866df80de4d3afa3838349f9b8c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e1e2866df80de4d3afa3838349f9b8c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\41B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\41B7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-27_9e1e2866df80de4d3afa3838349f9b8c_elex_mafia_stealc_tofsee.exe 9F176A5CFCBBDBF40A666A1DC53528970DD13C6EE764DDD4FF92627D049C97ECF1F44462F1789924AF1A2830367733ED91644ADFDF888FC2303488EDA05DACD7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\41B7.tmp
Size 486KB
SHA256 bbd7bb70284f5e3e3cc5f174db020163f2b58a5370ebaf394a2f7062926f1cb7
MD5 9d706ddbb2de771ee7e9c0b49d5257f5
SHA1 71a1143bf3bd93d1b4493808f2a84d62b4310e94
SHA512 c26ee67425c75904262b2dc0bc11addd58aead289bb21f09996723e567a762337bace5b7e1230d525351ce8611c1363b90317a4e7dcfd4be59d53feaeeb8159c
SSDEEP 12288:3O4rfItL8HPcM7zAfjvmBGaRCTr6uVU2oMa7rKxUYXhW:3O4rQtGPFQfyBG4CSuC2of3KxUYXhW
TLSH
T155B4F12AB6828233D2D301701BDADBD6A63E75711776D4C337E4027E1E61AE1D37A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download