ab232c393d5704890431906b2da5ec294f30f72b99a3ad3700f875f98f3e80d0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe
Size 448KB
Sample260718-eammtsaw4s
SHA256 ab232c393d5704890431906b2da5ec294f30f72b99a3ad3700f875f98f3e80d0
MD5 5b5cb741f88b9ac04b475fa842c15e33
SHA1 1b15bd7194dd21e784b96a12d437a1a27431e690
SHA512 1979473949788d5ab81000c26a76aab957dbd7b74def1548e56f217d5f3f8c7b655a7e6c7ec58248529b102f652db58b536024cb98cce82ed502c06f4f0ff8d1
SSDEEP 12288:lb4bBxdi79L9uJ+SOmXaLYGwRL4bdsNe/:lb4b7dkLEOzk/e1
TLSH
T10DA4E0243182C037D2A325394BE5D73955BA39A14B26E8D73BD4DB7E2EB06F1DA34302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4732	482F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4732	482F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	482F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4732	3024	2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\482F.tmp
  "C:\Users\Admin\AppData\Local\Temp\482F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe B1B496156D5057BBEB2FB850449E2AB77558BD2CC63497D75FDC2D8AC20B990D9D48F8FDEC7EE48A1C840AE0132443A5DE2C26ADF1E26E6669EA49B8690EA871
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

482F.tmp

Path C:\Users\Admin\AppData\Local\Temp\482F.tmp
Size 448KB
SHA256 b3e9a06241465151832271845b121992d179b10169453222df3601e25f15f5a9
MD5 e3bc47848692dacd1130e7c1ae6126b3
SHA1 41fcea776f77f57c9c3abaca2432a954222af833
SHA512 36a7c987b91c058d88c3bd5f52ea1296858b919d9d1d2485c31ab5265b6eb7b5cc8ff4345c5da35adc6bb261ea0c196bf599513cebce77bf4e2042612dfc0815
SSDEEP 6144:3FrJxvldL4c5ONK1tgRbd1s79+i5+gcLfLrZ1ZGcK+dQarmTutZ5ry6BaK//sq:lb4bBxdi79LJqXoiZpBak
TLSH
T198A4E0243581C037E1A325384BE6C776A5BA79A14B21E8D33BD4EA7F5E702E1DB31346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3024-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3024-6-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4732-4-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4732-7-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads