2515af4b64e4c4e0130e31a053c889d2cec082165f2ae03177231ee3ac42045d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_3bbde90bcad9a6b6914ea3e4b8b53e8e_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260630-mt2j4ac16w
SHA256 2515af4b64e4c4e0130e31a053c889d2cec082165f2ae03177231ee3ac42045d
MD5 3bbde90bcad9a6b6914ea3e4b8b53e8e
SHA1 7b3ec46fbc4fa5b6f37fbbe92a3f33ea88984a85
SHA512 65ebad5451693aa25a16909d9b212759200bd05d0bfaaa9d590f67f0f0756b3eeee31403d9f6dcd7259213cf97af410855a7acb98f9e9a3f8a95e9fa1993c72d
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHWBQkpQMcmyG67VMN2sZLA8uJjUOWEMZ:Zm48gODxbzI2eQ0yG6Rk2sYoZ
TLSH
T14D84DF247680C036D59A01314AF6EB71693A7CB28B6568D73BE07B6D9F713C1E73824B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1028	53F7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1028	53F7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_3bbde90bcad9a6b6914ea3e4b8b53e8e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53F7.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1028	53F7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1028	1904	2026-06-29_3bbde90bcad9a6b6914ea3e4b8b53e8e_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-29_3bbde90bcad9a6b6914ea3e4b8b53e8e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_3bbde90bcad9a6b6914ea3e4b8b53e8e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\53F7.tmp
  "C:\Users\Admin\AppData\Local\Temp\53F7.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-29_3bbde90bcad9a6b6914ea3e4b8b53e8e_elex_mafia_stealc_tofsee.exe 0FCA4B01B7F035288C5ACF9810E485022736480A2DB9DBFF1D463A0BD4004415682FE41CB7F3E7F28859E912039B908EE0A235C998FB39D8E57C9D93BC31247D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53F7.tmp

Path C:\Users\Admin\AppData\Local\Temp\53F7.tmp
Size 384KB
SHA256 54bdcbb9b73b98261c18532d8e5a9df4b4c81a1db050d5393aaec70ac48eed82
MD5 e930382b4c850e7a66a40203615bd0dc
SHA1 790ea0740690e2c3b160cdc13e41f0c8be57e5c3
SHA512 2cfb0cad1a3979a521cc12b7c0a72b806b0a97b89c109b2b1762e09c9465bf08ceefc6ceca1e317c4dca140d3715d1a6ad054c5816b70ff111d4aea022ed7079
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHMrerDs9vfPhY40+kePgUsnd+xZ:Zm48gODxbzuSBQA8xZ
TLSH
T1DE84CF347585C036E59705318AE6EB62193B3CB6972468CB3BE47B6D9FB03D1A63430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads