679a21744f8653776d9919e2edd911c754fa8cd231e8fca54020c70f8a3b31ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe
Size 660KB
Sample260714-rr72baew2m
SHA256 679a21744f8653776d9919e2edd911c754fa8cd231e8fca54020c70f8a3b31ff
MD5 dc8872b9c7b5836cc867150f977fe11a
SHA1 7ddf232ad224154d89100dd709af0a5156cf3baa
SHA512 614fc3a37cc0414138779ba415071683142b9629e2117caa71cdcd06135bd8ffcb8f2f73727cf928319fcba71929328acbd65ed58f6230cf0f377d26fa2302f5
SSDEEP 12288:NO4rfItL8HPx+MW73NZEHnpXbXmOF57tx7qg3kdI4S47ioeB/nNTnVW7vyk7:NO4rQtGPxRWbEHprZL5x7qg3kdI4Z7ic
TLSH
T19EE4AF2FB3450373C2C203B22B5B99D7F72EA579137A85D224A8802D1767EB4937B395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4564	68F6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4564	68F6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68F6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4564	4536	2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\68F6.tmp
  "C:\Users\Admin\AppData\Local\Temp\68F6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe F632D86F81579C18A05EADB461E43EF27758D2C80C70A9B4A955C11218E137CD9B45285C835CFAA8175125273A75D6C1F5A3BA72DF19BB49D9A78C77B38E84FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\68F6.tmp
Size 660KB
SHA256 b25a48c19d0442e427502c1b879c4ba31acf543592a7d6af9ccf1b362215f015
MD5 680285dfeb7187243ac5114c0ccf9174
SHA1 4ea9ab203f849e17bb37ded6d1e1db8681f56e80
SHA512 b595b19ad34038ad44015f2019b324784ee52272aa6be703bebbccc635ecb07e19b0ddd8c1c98dc9e5eff3244241362f81ed3da1e4f10b39f63d4319a085cca5
SSDEEP 12288:NO4rfItL8HPHgnpY4V9ffChDd9dFi7tx7qg3kdI4S47ioeB/nNTnVW7vyk7:NO4rQtGPHgna4VVk7dFi5x7qg3kdI4Zf
TLSH
T1DFE4A02FB3450373C2C203B12B4F99D6F72EA575237A85D224A8812D1766EA8D37B3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download