2a78e842a9eb4bcdedfe2d70f35a8b7515998b27e344a48380c9254bde73311e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260718-d2mapsat4x
SHA256 2a78e842a9eb4bcdedfe2d70f35a8b7515998b27e344a48380c9254bde73311e
MD5 6957adeb8d3ec1a8d431b959c5b915e6
SHA1 d9aacc20eb2fa6b2c6951e16998b389432cc5a57
SHA512 7abc14eb9e6873ba76fc608eee88a23261fdf99d02acf528a5c2b1a80198302f0d662637f6bbc1cc3b86068536b6f322c1cc141c2d681c21b0793ea223ca26c5
SSDEEP 12288:Nb4bZudi79LoR9Y1hj4bUg+c1aBYdnWGA:Nb4bcdkLHhjGT+cQOdW
TLSH
T1D2A4F0247182C037E1A716394BEAC735667E79A14B25A8C73BD42BBE1EB03E1D634353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1492	F9B.tmp

Executes dropped EXE 1 IoCs

pid	Process
1492	F9B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1492	4636	2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\F9B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe 04D9862867FEC52B68EC6D52A46CDF2B3725B4882D40A7B76D05C19F40A551B12D513092DBB0DF3B283D6268B9298C62D3CBD7AC9583C1D112997076629BFA30
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9B.tmp
Size 444KB
SHA256 152512c49e7bcc917b34ddd166585214e29bbea8fb00e6cae2800041f5cddfce
MD5 dd567fc9139f25482049e55de308e10c
SHA1 432b2a4be78e1b7fae33f40fe1491ffc2c596011
SHA512 d76df0aa1563af8df67a72f91d8097b9395793ff7e15f3e2619b4b57a5ea6ae0b05d83206dbb3ff8d3e502136726231c9f33507003c827d92c03c5be7a29f457
SSDEEP 12288:Nb4bZudi79Ly3R8uKa6PgJgTaEgF9zWFKLcUA:Nb4bcdkLyB8ueu/EgF9zfLc
TLSH
T13CA4E0243181C037E2A216744EE6CBB6653E7DA15B22A4CB37E457AE1FB02D2E735317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download