6e3f75ec297025c144d3970d9bf48e5a8e15fb94eed2d0c0e8948a97c91a8c7e

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_8cb8f496f48e72de08ea7e68626b4eee_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260630-he9vpshs21
SHA256 6e3f75ec297025c144d3970d9bf48e5a8e15fb94eed2d0c0e8948a97c91a8c7e
MD5 8cb8f496f48e72de08ea7e68626b4eee
SHA1 626ba5a6c40ca0b7b2da63fb2cabace6e4492c8b
SHA512 71d5a0fd60923014ca8c8a1767850518568ce891e18da4c58d7742c1ccc42879b80cc0b1cecc90799709f57e049b4a23f25ccf9920ccff52f66a42d3d2c54dc1
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6zmkTLvKb8eJAQ8mNMAyTHJXaJRZkxd3Pa:Wq4w/ekieZgU6XnvKPm/AyM+dS
TLSH
T16394E0343586C03BD2A716348AF4CA6A6A3A7D700B35A4C73BD42BAE6E752D1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1672	4561.tmp

Executes dropped EXE 1 IoCs

pid	Process
1672	4561.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_8cb8f496f48e72de08ea7e68626b4eee_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4561.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1672	3980	2026-06-29_8cb8f496f48e72de08ea7e68626b4eee_elex_mafia_stealc_tofsee.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-29_8cb8f496f48e72de08ea7e68626b4eee_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_8cb8f496f48e72de08ea7e68626b4eee_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\4561.tmp
  "C:\Users\Admin\AppData\Local\Temp\4561.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_8cb8f496f48e72de08ea7e68626b4eee_elex_mafia_stealc_tofsee.exe 19599DB5584D78672BDFB7346EF57F2E9E1F48A253952BAA81A9F3FCE98BDDDF6C10CA749CAE66DE2BEB6FCCBF398A814DE1F1A25B79DE422A3D0788BEF0C5E6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4561.tmp

Path C:\Users\Admin\AppData\Local\Temp\4561.tmp
Size 414KB
SHA256 e2a6b1b9e8176472949812d4c2b77bd3e635d732a8264b157f33dbedb9823e09
MD5 e682f0c0e8e059731b5830b968ac30a0
SHA1 5bc82b706ce5195812f9f77ebf599a9e4662f132
SHA512 f3e705b6036b01cfa019752127f8f611f03c81b7dd8fd9899d7c48e62ce5e516a883ae98306a088ebee39d398f626cf0e199230a9a703b91bcfcbe0e99f555e5
SSDEEP 12288:Wq4w/ekieZgU6kRYXSDORYB/NBJ8mHEU3:Wq4w/ekieH6kRYqORYBbd3
TLSH
T1C194E0317586C037E2A716348AE5CB7669397C644B32A4C73BD02BAE9E712D1DB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download