e817f8f26b414775014faedb31f4cf7930a87f4e482a828776d41068c61b18fa

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_1dc755a344d5b756b2c2c3c8ed090be0_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260718-1sxreadz2n
SHA256 e817f8f26b414775014faedb31f4cf7930a87f4e482a828776d41068c61b18fa
MD5 1dc755a344d5b756b2c2c3c8ed090be0
SHA1 08ec5b8ca22b76d7722faf67b3f7334665f0808b
SHA512 64bcdd8d55d23daedf838e513482efbd13508b35d422e2a6bdf2da83d34fa464b316e0f57460c263c165bdb8af03d87979ca5dbb6e750d95a7b96f0823f9182e
SSDEEP 12288:Nb4bZudi79LHk05pegFqcBLyUcf7pYEt1tJA0a:Nb4bcdkLHxygFqcBLcf7pYOo
TLSH
T1E2A4F0253581C037E1A702354AE6C7B6553E7DA25F71A8CB3B9077AE6EB02E1DA34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3172	1D09.tmp

Executes dropped EXE 1 IoCs

pid	Process
3172	1D09.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_1dc755a344d5b756b2c2c3c8ed090be0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D09.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3172	3592	2026-07-18_1dc755a344d5b756b2c2c3c8ed090be0_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-18_1dc755a344d5b756b2c2c3c8ed090be0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_1dc755a344d5b756b2c2c3c8ed090be0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\1D09.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D09.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_1dc755a344d5b756b2c2c3c8ed090be0_elex_mafia_stealc_tofsee.exe BBD48B39E066E70E9B70C2C65B3C7FED36FA0EC1B946899562CC26EBF926117FEEAB2D36093F05F737939F1860978FDF1462462E156D1C256230607B6AE600F0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D09.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D09.tmp
Size 473KB
SHA256 1102cd314c7a1dbdae89b0190e845badac90d4300a3342abec9d15c59cc21d10
MD5 8187abc093856429fbe940609633f788
SHA1 7f722bcf96a741442eaa30dc4649f203a1907879
SHA512 4b6daaa633f7bbb9f4b4e63085a16ec80f389c269d8b688eaba98786876e1acd23b877790f3169f9c9602ca73de42f77f51aa6e3caec8a2ecb9bcfa31e4f41ea
SSDEEP 12288:Nb4bZudi79L77yfy52idBhp+uXiHOXwvGOVSXOQA0a:Nb4bcdkL70yYUhwuyuXwuh0
TLSH
T1E2A4E0243282C037E2A715384AF5C7B5653A3DA19F7664CB3B943B6D6EB02E1DA31707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download