25e2b27158ed456e3c586e220405faa7bdae50cc30c01bb3f33c42f627c9d06c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_e9e98fa86dcb7ea84ce29cd30fab1895_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260630-cbe82acs9v
SHA256 25e2b27158ed456e3c586e220405faa7bdae50cc30c01bb3f33c42f627c9d06c
MD5 e9e98fa86dcb7ea84ce29cd30fab1895
SHA1 1a604c80020237bacc1d865ddaffce2ad0ee424e
SHA512 08546897206b4b6359117275254e23c77b8c21edaedffb91ee024d1968edfd078f769b8e8993179de56856ae2c6f56b30c68d27b149fea3603bc0882dc46eb59
SSDEEP 12288:fd4x+ePixnXQjx29lg7EqydSYzqOpcoXsoxu7PwP:fd4x+ePixAjx27tqC9coXo7P
TLSH
T16F94E0213686C037E1A706384AE0CB69693E7DA54B36A8C77BD427AE6F705C1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3480	3832.tmp

Executes dropped EXE 1 IoCs

pid	Process
3480	3832.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3832.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_e9e98fa86dcb7ea84ce29cd30fab1895_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3480	3920	2026-06-29_e9e98fa86dcb7ea84ce29cd30fab1895_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-29_e9e98fa86dcb7ea84ce29cd30fab1895_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_e9e98fa86dcb7ea84ce29cd30fab1895_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\3832.tmp
  "C:\Users\Admin\AppData\Local\Temp\3832.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_e9e98fa86dcb7ea84ce29cd30fab1895_elex_mafia_stealc_tofsee.exe 59E93C1E81E85D7160F8279671174D2752CAAB9ECCBEBCBA28319A65A0170088529C9348B2F9B4964305CF660CA6BBB0930ED845C684633695B4690BD3BA75F5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3832.tmp

Path C:\Users\Admin\AppData\Local\Temp\3832.tmp
Size 435KB
SHA256 212ce8b5447913c198df4dd6ce5ee3a923731c73831d2b6d81fa3483df41529b
MD5 24df30f3c81bf29a86985b390ed0fd04
SHA1 7d4d1f864e22d11889d981b95d06c9f55fd1b86b
SHA512 d8511813decc264c1cbf73ac2fa882212344c72a9e1e69d020d77ca67070d3d6c591705f28ecf5adbf0598c0e8be3ec7ce8ac30a304e89cd076fa503a268f2bc
SSDEEP 12288:fd4x+ePixnXQjBOY3KYRb7F4Uh6XeO4wP:fd4x+ePixAjBO9qO4
TLSH
T12B94E1213681C036D1A716388BE4DBA9693A7DA44B72B4C73BC42BBE5E702D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download