0a4104b920d9a9e735975bb556307c32d0490b9918bbef1f74c8af6964d2fd91

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_3fb1148e9d7477b9f224edcabd965fad_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260701-ya35csft3x
SHA256 0a4104b920d9a9e735975bb556307c32d0490b9918bbef1f74c8af6964d2fd91
MD5 3fb1148e9d7477b9f224edcabd965fad
SHA1 3c5add5c679b223eb087f4b322e74d6339394d23
SHA512 409c95e560f61478316ecd44ef589fda2c5394167aba10276382fa7cd57c315c0623063d71754074948144f137717817db82d1db4b2978dcdf6506bd1125134a
SSDEEP 12288:Nb4bZudi79LiMi5AdCXFLF/EmrGIX5QNEkg6A0a:Nb4bcdkLiMi5A6fLXeuFR
TLSH
T14DA4E0243192C037D19702344BE6C7B5663A7DB18F2569C73B907BAE6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2068	134.tmp

Executes dropped EXE 1 IoCs

pid	Process
2068	134.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_3fb1148e9d7477b9f224edcabd965fad_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	134.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2068	2732	2026-07-01_3fb1148e9d7477b9f224edcabd965fad_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-01_3fb1148e9d7477b9f224edcabd965fad_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_3fb1148e9d7477b9f224edcabd965fad_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\134.tmp
  "C:\Users\Admin\AppData\Local\Temp\134.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-01_3fb1148e9d7477b9f224edcabd965fad_elex_mafia_stealc_tofsee.exe 8E9F92BE6B572B976E17B4476AFDC9D90ECC83359061E4894538463F90B8994295EBE5AC76F419BF5252CE68C8E2756BFDA48FA06E65FC0127C71877FCFED474
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

134.tmp

Path C:\Users\Admin\AppData\Local\Temp\134.tmp
Size 473KB
SHA256 758ec9cc799f4ffb79bd64586333d8762959098f4118384108be0547c838af00
MD5 1834acef1aab14172db72a5d18042267
SHA1 cf54dda671bf4653d8bd27df2fff3a1297732bca
SHA512 b3fa16b65adae27824de8dda6d2ca254015c5cb538e193a2209692a280f9a5c55b666ba7ffae868c4884bfd1ea09378af990be5f7b02c8897e7e6e8a50f3d69c
SSDEEP 12288:Nb4bZudi79LFVK8Gu2efOK3wpwBk6HA0a:Nb4bcdkLFN2XK3Kt6S
TLSH
T103A4E0203582C037E2A716350AE5C7F5667A3DA19F6168C73BD43BAD5EB02E1EA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download