1720b11812cdba7257d86b3bb507f6be72a4b8232fe3292bf927f124f36a78cf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260717-fned2sbs8m
SHA256 1720b11812cdba7257d86b3bb507f6be72a4b8232fe3292bf927f124f36a78cf
MD5 e37d43d7cd83ca979d0b3829c30498ac
SHA1 4e4d891365eba1292a260ef26678bf17c2354d46
SHA512 c44471d6926a797cc5ac594cba56ea4956bbf7861fce8ecb4c0ad0aa826ef4c96b8edd77899a7a470596a7cfcc7a0582d5778a8f79d8701cc8aff5353f804072
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStLtWFsQGeJtq+OS/K8Ahou2knSvGGIpcs18J:Nb4bZudi79LEYlGkXS8AhoNvGxcsNA0a
TLSH
T150A4E1243192C037E2A716384AE9C7B6663A3DA05F2668C73BD4376D6EB03E1D635317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5076	AD42.tmp

Executes dropped EXE 1 IoCs

pid	Process
5076	AD42.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD42.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5076	4524	2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\AD42.tmp
  "C:\Users\Admin\AppData\Local\Temp\AD42.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe 4FA96B8AF5BE5962588D4604202C8BB9D664202C0CED244B3EEC7C1784BBD33F9AF2BD210D2047EE5D74E6279DC101DB142F0070BD339B7331B2A86178C63E21
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AD42.tmp

Path C:\Users\Admin\AppData\Local\Temp\AD42.tmp
Size 473KB
SHA256 81330a8e31eceacef5eb8a8bd98f96d59c26ccb0ff5ac818988e86e0173e3ebf
MD5 5c49403e85c3b6079295cd133fd95a76
SHA1 c7423afe73714089d349c0fa51134c9c99ca02ef
SHA512 db3a98e693dbb1bd8d901534e12423ff0f27ea50626507a1e232544a143c33998b59202569eb49d8c77acf8989337b7a26b43d4f7b96be0ced6e512f78297103
SSDEEP 12288:Nb4bZudi79L8FzTzEm2M5cl7wW3knvQEoHurA0a:Nb4bcdkL8FzT4mi7wWcoOu
TLSH
T1D8A4E0253182C037E15716384AE6D7B6663A7CA19F7168CB3BD07B6E5EB02E1DA30347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download