5b4e626df666a6f6ae3f768ee84f35da161ee522e0eb7bc165066a64253a6e11

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e84812c713a23d1e4b39c3858ff7d98d_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260717-zgbt5ahv21
SHA256 5b4e626df666a6f6ae3f768ee84f35da161ee522e0eb7bc165066a64253a6e11
MD5 e84812c713a23d1e4b39c3858ff7d98d
SHA1 62844bb47f3e79dad300ae0207c4b5bcd5c107ae
SHA512 1072bd3717ca6de61fb43c53f504e2b15576d07f21d90097709aebcf84d54d71aa33f2ab5edcc9c93bfdf2dbbb872652fd2e7830b4fd53787b08af8090b57746
SSDEEP 12288:Z594+AcL4tBekiuKzErwvDj5OuYaQe+ZODriB8yMl:BL4tBekiuVrSp1Qe+0H48yM
TLSH
T12694F1313182C037E29B16384FE5C76A19BE78B60B26A8CB77D04A6D2F646D1D73435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2064	59.tmp

Executes dropped EXE 1 IoCs

pid	Process
2064	59.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_e84812c713a23d1e4b39c3858ff7d98d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2064	1572	2026-07-17_e84812c713a23d1e4b39c3858ff7d98d_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e84812c713a23d1e4b39c3858ff7d98d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e84812c713a23d1e4b39c3858ff7d98d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\59.tmp
  "C:\Users\Admin\AppData\Local\Temp\59.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_e84812c713a23d1e4b39c3858ff7d98d_elex_mafia_stealc_tofsee.exe DDFC0BF2D1BBDF8426537EF48691031F48F18C34649126D8E9473CC320BC7153418FF8F5946F89BF1B03F2EF8D3A729AB5B4A1521AAC5005DF50F4E60070ADA3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59.tmp

Path C:\Users\Admin\AppData\Local\Temp\59.tmp
Size 428KB
SHA256 07588ad1c72a097452e3abe74c971ed476e8f7cdf9771f4aa98ed7a43fa95f76
MD5 fba77ec3695ae7a14c28cfbd50591971
SHA1 cc45aa164ef984f8a79d47e15662322a54b0f26a
SHA512 744d35385383dabc491ffc3d3210f2f53067358716f7827bbf05b9cfed7c80048f15963ec4fd5337a0123ba9c702f1ea674e8a59aede86a83341e6382b402505
SSDEEP 12288:Z594+AcL4tBekiuKzErtA3frN8AVFNuyi+OM5rUiYLl:BL4tBekiuVrtA3fh6yxrUR
TLSH
T16F94E0313191C037E2A711344BF5CB6A693E79B20B22A8CB7B80177E6EA46D1D734387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download