0d5c6340f4292be04e9e28e53f153872113398f186688ed6ad99f076ff4ece97

Analysis

max time kernel
149s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260718-ej56jafw8n
SHA256 0d5c6340f4292be04e9e28e53f153872113398f186688ed6ad99f076ff4ece97
MD5 4c29fd59b7f0815f7b63ec65f9433124
SHA1 a352c8a9b23db4e79eb7bc2b65edfa86a2546f1a
SHA512 7580a523ffb7bb5f8c07dc9f673769c51cbdcdf61c636676ce2aaee4d8587f95cee845b63c3d8e4e7031f5c9b34965a7fb35762ec1498befb888bb7a991a716d
SSDEEP 12288:fd4x+ePixnXQjSzhlItLWTQBMaAduN+RtwP:fd4x+ePixAjIha8QBuF
TLSH
T15A94E0203A86C036E1A715354BE5CBA9693A7DB04B36A4C73BD437AA5E742D1CB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
892	631A.tmp

Executes dropped EXE 1 IoCs

pid	Process
892	631A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	631A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 892	4004	2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\631A.tmp
  "C:\Users\Admin\AppData\Local\Temp\631A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe B6866AA81D54EA271DF8BB25415717D6038052B20829310570A2888B03E38C176ECC1498CCB7DFABC1B11DD4A010ADD1D7331B1E8E60AE80C6E1F440F3D7BBFE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

631A.tmp

Path C:\Users\Admin\AppData\Local\Temp\631A.tmp
Size 435KB
SHA256 b160db7257102f24f629c34ef6f764b9716d041c1f11c1208d7b62d5f3fa193d
MD5 5754e2f0dc22419403933e86e1f43e75
SHA1 39c910990435a4d06c94a1d403a37bb0334cd4e1
SHA512 f4c0a4bee4e2ecb15113c9e37baff6c582cb29359dc6793cdd176dd8ac92394f43058cb4a1185175367872cfa5fe436032d31d94da0b412a0b59656b9280a156
SSDEEP 12288:fd4x+ePixnXQjr8+cxU2S4j5ah6zHU+CbfLXOowP:fd4x+ePixAjg+cxU2Fn7BCbTXf
TLSH
T18994D0213182C036E2A706348BF1DBA959797DB14B36B8C73BD42BAA5E741C1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download