84f4b83df651cf5edfbc6e54cb88ec44b8620c87dab62ae2eb83a211fb4a7a06

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260715-dbd7eaas6q
SHA256 84f4b83df651cf5edfbc6e54cb88ec44b8620c87dab62ae2eb83a211fb4a7a06
MD5 5c4ae4de7e674cc5e5b9e1deef73c123
SHA1 b50c5bf6ec7c6fe5d80058a2fc4d5ff83a3763f6
SHA512 da3745a9dcac86caadd17b6a5a393a4a64365c929c441a46bb2b8d1180f5b06869faa189306782992c5a88b19725137c1c6d38c581b63fd938b27def6ef444cd
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYd5rXCiF6K3nRsjF9wiHg/Dy7AWZx9w9J:fd4x+ePixnXQjgrVnOwirRZfwP
TLSH
T1FB94E0213582C036E1A309354BF5CB6A693A7D754B76A8C73BC42BAE6E342D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	22F4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2716	22F4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22F4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2716	3128	2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\22F4.tmp
  "C:\Users\Admin\AppData\Local\Temp\22F4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe DF55AC4969151E0E854D0F505F9CA0CCD8BE275CE3265DC9D4489E4E78D8189672C8A757E9DDCA48743314DF12DB5085160CA6746815C5DC117EF654D7F957EC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\22F4.tmp
Size 435KB
SHA256 17a59b765ddf657df3b298c77d6d719d8f8c33dea322f5de308c8e584f950a23
MD5 e27f3efc38ac8db076adff7a06dda77a
SHA1 f797b1ef9402278eafd785eea8b91a4e2cec4c30
SHA512 9abe1e4c0c748017f92755338eeff2cd9cdc06ff08a07c21074e30a82b15b965a9cad16cb0d7e176fa2e92732ce1f6ca0f3a284c72c0bfd8946f1c6e55dae3b5
SSDEEP 12288:fd4x+ePixnXQjz3b4zt8408/0UOR6KyYPzsjwP:fd4x+ePixAj7OtUxPzsj
TLSH
T1DF94E0213682C037E2A306388BE1CBA959797D710736A4C77BD427AE6E752C1DB7434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download