258b12f4ed5088e1b9b867ba01ba6002a7d35f4dbeca675462208ad8f43311b5

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b503406440fdf902af8e33d5e66fee48_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260630-e8ls7aew9y
SHA256 258b12f4ed5088e1b9b867ba01ba6002a7d35f4dbeca675462208ad8f43311b5
MD5 b503406440fdf902af8e33d5e66fee48
SHA1 32e65c4d71f2758fcf8b4cbab9cc75b758913cfe
SHA512 29e184d02a772c52523115f967677850afe8c6dbd8545547afb35891d4ecea0da8dbc88a66ab5bf8c3b6aabcedd1da8689d8fa431dd28206a31192255bff4f02
SSDEEP 12288:Nb4bZudi79L/ETfgcB58WCkWSmPXLJk+0A:Nb4bcdkLMDgcX8WCjK
TLSH
T15DA4F0343581C033E2A319744BE6DB79953A7DA14B26A8CB37D05BAD2EB43E1DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5100	1E60.tmp

Executes dropped EXE 1 IoCs

pid	Process
5100	1E60.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E60.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_b503406440fdf902af8e33d5e66fee48_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 5100	4500	2026-06-29_b503406440fdf902af8e33d5e66fee48_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-29_b503406440fdf902af8e33d5e66fee48_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b503406440fdf902af8e33d5e66fee48_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\1E60.tmp
  "C:\Users\Admin\AppData\Local\Temp\1E60.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_b503406440fdf902af8e33d5e66fee48_elex_mafia_stealc_tofsee.exe 004A6D1073EBE6667D69C2BDBBFDE830CFDA91B39BF6CA50DF7F36E18CC17115566291E83955EC73F3A019E967F2922463E06F79203B852CFF4E8838C7C9EF60
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E60.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E60.tmp
Size 444KB
SHA256 a857f7ef7241571a055633686adf32e1cd4c7c91f7d1ed0981b788cd21551156
MD5 02d48f38faab5f7cd3818952734d6b74
SHA1 192b26653f0299ea7506cc1fafe547bab3810216
SHA512 461324e47150982188b30f48a28040425f00813fa71a4ea43f68c95676fd890e2693bee44482f2ed0929395c50c934ae09fa95e31ba97928995d6ac9c67f1a9d
SSDEEP 12288:Nb4bZudi79LmDw+KI/o4qI0pqzAbmXYgqA:Nb4bcdkL1I/WITNYg
TLSH
T1B4A4E0243582C03BD2AB06358FE5D766653E79615B21A8CB3BD06B6D6EB03E2D730347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download