9037a2659cacc7f1ea588346618cf4f0d8a083b68b7c0d16bfdcedc7bb138144

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260630-e8ed4se18l
SHA256 9037a2659cacc7f1ea588346618cf4f0d8a083b68b7c0d16bfdcedc7bb138144
MD5 b51802befe6434a9db7a4e37dc15c0d5
SHA1 946a851fa404e8a05f97dc318ace6115439e3c81
SHA512 a0e0c05bda2a638ddd297b730700a34ed5e2d46859aae0bd625a4ceebb81a1a3f851e9abaa227986eee7c63c93c87937472aba33bf0bd419742f299d9d310f4d
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHtmFVhBfVp6RRy6+CW00EvIyZ:Zm48gODxbzqvrATY0pvBZ
TLSH
T12184DF34B581C036D1A701314AF6EB62593B3DB24B6468C77BE43B69AEB13D1E63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3432	44C4.tmp

Executes dropped EXE 1 IoCs

pid	Process
3432	44C4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44C4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3432	44C4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3432	1100	2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\44C4.tmp
  "C:\Users\Admin\AppData\Local\Temp\44C4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe 1C151B335E101B9C37FDC1DCF7E2670A91F8786A878BE4C43CE94A44C37EFC9D483E29A9773FDD0CB6C33A28954AC0D5A755A2588A385D6DAC90BD008E43C376
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\44C4.tmp
Size 384KB
SHA256 21c05a94c8cea6d9710621d18438dbd70575d6623ca87f2bbbdc9a51ea637a97
MD5 3d99069f9bbdce8103bb7936f64af5eb
SHA1 e5693f069f2b70ae1587e4ff52fc3a9a4cdf7fee
SHA512 a23337f6b492c4cc4cd14c379b1de515db35bd42848d91b086650f829ff1a997c6b488c6ec5c9849a8d1d04de290bdce13b8b330ec7f647b1f317ece3eb3ea05
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHt84BYOSNfK94Vio4XNkydb3Z:Zm48gODxbzn84HJiiogkyt3Z
TLSH
T17E84CF247581C033E59602314BF6EB625A3B3CB2872568D73BE47B6D9FB13D1A63420B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads