216dbddbfe8535b17f8ccf2d496738fc3f65a01f042b6968eb5efc57fb81e415

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_ea513971ea4eded99a625c2938a678c8_elex_mafia_stealc.exe
Size 435KB
Sample260711-pc26eahy7q
SHA256 216dbddbfe8535b17f8ccf2d496738fc3f65a01f042b6968eb5efc57fb81e415
MD5 ea513971ea4eded99a625c2938a678c8
SHA1 fa34b41a2fad81d648bdd266b9bea7295d736800
SHA512 69be34db1c0f5cd7d28ed2b1e70dc487c99f99675a43b8b818796e15100150f8ad8df6dfb02a2f898865a0842d95a229a6603833edc5ea84fadcd9421835b95b
SSDEEP 12288:9W4ufepiqKQ1mtNLxyONjGUpkdnobLEr6d2J:9W4ufepiqhmnxyC6GkdoXW
TLSH
T1C994E1317586C036E1A706384BE1DBA9593ABD654B31A8C73BD42BAE6F742C0DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4484	390C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4484	390C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_ea513971ea4eded99a625c2938a678c8_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	390C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4484	2700	2026-07-11_ea513971ea4eded99a625c2938a678c8_elex_mafia_stealc.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-11_ea513971ea4eded99a625c2938a678c8_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_ea513971ea4eded99a625c2938a678c8_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\390C.tmp
  "C:\Users\Admin\AppData\Local\Temp\390C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-11_ea513971ea4eded99a625c2938a678c8_elex_mafia_stealc.exe 7FAB085F9347164F8E9DA2805B9506346967943A54EBB6E5C7D03678DD6064376EF8F60A43ECB817C183D1F2608E884073FA05D1F07F5B58DA0CA214A6F7B5AE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

390C.tmp

Path C:\Users\Admin\AppData\Local\Temp\390C.tmp
Size 435KB
SHA256 417e3d4be649c1d075c043ca51b770cc5fb5e37159d9b8405fcd118fab2edb42
MD5 a017ec29eadafa26eff0e4739ae179cc
SHA1 816c6ade719a83831f8119c21aa76e12dc5b5d17
SHA512 b5aaa21b22c94336b94ddd7129b196a781018dd426085e3af3c4ba8049227e54ead6edbf8f98cd70ec403bbfd7fb08fc213ec7ef52aecae5adbc49bab358f8a6
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBY9cjhyWjd+WtHbd6wpJ1BxCGP4vroyJK:9W4ufepiqKQ1mZhyWjFthFp3mGP4MyJ
TLSH
T14794E0217282C036E2A715344AF5CBA6597E7DA04B36A4C77BC43BAE6E341D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download