39f641f0d5bef58714ff6d52a480dafb7c17c78bc7b3bb10b1764f12167df1e6

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260630-2qrm2sa16w
SHA256 39f641f0d5bef58714ff6d52a480dafb7c17c78bc7b3bb10b1764f12167df1e6
MD5 4d169c8c5d7a8e36633bc03d42c8cba8
SHA1 9755e89e6221ba8380bdfc66f516cd0438faeab5
SHA512 7488dcfa1e52f7cf9413a7585bf0ef9eceb73766e99687017da236838ca6e5fad93ed6a83e8744550aa79ce726bf30e75f0dda2d53d2c24e5d2e19a114f2b15a
SSDEEP 12288:qO4rfItL8HGgvR+G2jkZUMAa5kz7bWmeEVGL:qO4rQtGGM0G2jkZUXzumeEVGL
TLSH
T15EA4E0367241C133D1A202755FEADB6AA73E75704726A4C33BD442BE1E652D2E33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
812	3FF2.tmp

Executes dropped EXE 1 IoCs

pid	Process
812	3FF2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3FF2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 812	4460	2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\3FF2.tmp
  "C:\Users\Admin\AppData\Local\Temp\3FF2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe 8E08AD075E5F199D55EE9A4BEEFF8A99BF9266ACEFDB1518F96300998B80A8DAC93002CCA2DF08140DCA9847BCBA46B2088835E2C26E3F142B76A10FD90E95F4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FF2.tmp

Path C:\Users\Admin\AppData\Local\Temp\3FF2.tmp
Size 468KB
SHA256 a31f0ebfce5eef95344f84364e393d69110eac84986861ab758185e16c57ad31
MD5 432346e4879e915da194e2a171179865
SHA1 21ca052999fcfec400d458f0ecf671cdf50a9d23
SHA512 d06a209eea48e72b6b9c1035e652050e66949cdcf3fa7f3982db9e2107399f4dd379e9ab793963eb50596e9c9c9c3911592049c65fcb85d77812cb22de29b5f9
SSDEEP 12288:qO4rfItL8HGvk0neQsal1Y+7blXPUy64mrqBVDQXh37bWmeEVGL:qO4rQtGGvkPj+/lXI4mhumeEVGL
TLSH
T17FA4F1267246C133D29312751BEAD7AABB3E75B14326A4C33BE4027D1E616D1E33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download