6ca4e8706124cffc3b7f81263a82fd997d6424a5528e3e2c0feb262c2741afb1

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_d0a7a11999eaeddece40b2c3eefdf3aa_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260707-a5secaex5v
SHA256 6ca4e8706124cffc3b7f81263a82fd997d6424a5528e3e2c0feb262c2741afb1
MD5 d0a7a11999eaeddece40b2c3eefdf3aa
SHA1 673f115192686cdaf4fec74b21b0a134a22d60fd
SHA512 642469963f504a401790802942b2b10632e8a9bee5f849aeff657b1da4c74b0b95e1b9dadf8b0f28adac2ba90f1f586cfa28a3d874244518e863f79d911e518c
SSDEEP 12288:4j4pdePiuVZPL+lntNOUBgdDzyHukSHsT68OK+8:4j4pdePiufL8nvCHuT6ZKX
TLSH
T19E94E0307156C037E1A705348BE1DAA5693ABDB15B32A8C73BD02BAE6E742C1D73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4924	85F4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4924	85F4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_d0a7a11999eaeddece40b2c3eefdf3aa_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85F4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4924	820	2026-07-06_d0a7a11999eaeddece40b2c3eefdf3aa_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-06_d0a7a11999eaeddece40b2c3eefdf3aa_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_d0a7a11999eaeddece40b2c3eefdf3aa_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\85F4.tmp
  "C:\Users\Admin\AppData\Local\Temp\85F4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-06_d0a7a11999eaeddece40b2c3eefdf3aa_elex_mafia_stealc_tofsee.exe 0150763AF3846327B07863FA8EF916204625FB778D537D0501688BFAB31F9DCBC9A2DC868123835C12A47E49ACA3C68C09468E0A451479F2E4169358DE0BD2EB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

85F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\85F4.tmp
Size 435KB
SHA256 d0cf5787cd4bc42af02cee69eff8934c8b7508019487b993963b92570e561e06
MD5 8c6e9ba779715ca0b7ad44f04032d656
SHA1 178bdf439e3ac81b979e2a47f428e63df59abc85
SHA512 2b3f6bfe981260f85719051f93d70fcef32446afdf6ce73e6c34db7af59d46210605935d587148538f111956f91ac4297d496827becda2313421906784175c83
SSDEEP 12288:4j4pdePiuVZPLcM6G0iEIHQlDuDDc7t+8:4j4pdePiufLcMdPdQtuDDcBX
TLSH
T1F394E0203142C037E1E316344BE5CB696939BDA55B36A4C73BD42BAE6E742D2DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download