291acaf2fa7f0a3d68b39f76cd9c95317782f63686023a14f6458c2fa3b4f20b

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260711-sethtsez2v
SHA256 291acaf2fa7f0a3d68b39f76cd9c95317782f63686023a14f6458c2fa3b4f20b
MD5 dd7afe198f75d1cd248de78d6f3d4884
SHA1 9990a38c2719c8f0f1bad820305ac47832cbadfd
SHA512 7b0ebad6ec28d215b933777ae61b1e24568f3907b3236592c043576432bfd1a435c34f8dc5630644c68d9c7516577a9da3a779b015c459517613553e83f0bee0
SSDEEP 12288:Nb4bZudi79LSfFPivdx1My1fV9cRBIg90zznBoEA:Nb4bcdkLWivOy1fVWHIgeXBo
TLSH
T11DA4F1243581C037E2AB11385BEAC736663E7DB05B22A8C737D46BAE5E702E1D631357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5000	53A9.tmp

Executes dropped EXE 1 IoCs

pid	Process
5000	53A9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53A9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 5000	1364	2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\53A9.tmp
  "C:\Users\Admin\AppData\Local\Temp\53A9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe C861874D2C95FDE37F17009013DB59FD582610FA0950C12C38E59A30C5E9457E6A801259743F00F9F7F5BF1A28A66775272FA50BCC08E12B4629BBFA09BF4F9E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\53A9.tmp
Size 444KB
SHA256 b19136846b59471e594bdd3db8be84a3aaf2cb1d750715836184fa7f9c56ca37
MD5 f70a701bdc5c6671380d61878386acf3
SHA1 97d0e4840c1f609c73210adb7e8fc5baf0e2b37c
SHA512 aca2fe019d15b090322f9fdac7b4a513a38cdfebf9e03904f3e43d450056f790b7f087ef326ecb8e61568e338b3224241cc46491c21e87253ec884a8233cb13b
SSDEEP 12288:Nb4bZudi79LJnoH+1LI3F/QNMP88CT5+qF3XIA:Nb4bcdkLJoT3OeP88O5+U3
TLSH
T143A4F0343582C037E29315348BE6C776A57E79A15B26A8C737D41BBE2EB42D1EA30347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download