8514ba44eb3ebcce06bfdf9ff5ca6c6e5f42ce49364ed3234a62f573227f5f1a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_09919a7a0268f7914abee3e09904a882_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260718-flexssgz5j
SHA256 8514ba44eb3ebcce06bfdf9ff5ca6c6e5f42ce49364ed3234a62f573227f5f1a
MD5 09919a7a0268f7914abee3e09904a882
SHA1 575c5c56022507056525f9ea04a2d5efca3ae2a7
SHA512 be09a07e97f23e013ecfcebc6bed85cfffc4a99358b7ea79716a0b7e0789f53cb8c8c6e6637f777296fc83f53481c1d78ca572bc082df4e11cb5ce44701f7456
SSDEEP 12288:bO4rfItL8HAb2jJAfIYUcqO7spI7V975UO:bO4rQtGAbk9wqGspIjVUO
TLSH
T17BA4E12A7680C133D29302750BE5D7AAB63E78704736A4C727D4467E2F61AE1D37A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4444	5F9F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4444	5F9F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F9F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_09919a7a0268f7914abee3e09904a882_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4444	2172	2026-07-17_09919a7a0268f7914abee3e09904a882_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-17_09919a7a0268f7914abee3e09904a882_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_09919a7a0268f7914abee3e09904a882_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\5F9F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F9F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_09919a7a0268f7914abee3e09904a882_elex_mafia_stealc_tofsee.exe 4D78B2F9AF9C726A057B5AD3681ACED789616CEF95CD273BD0E2C02305C83C1EFE3E2CAC88184A14070BD9ED012A548196EBC2EAF202478104BE2C255BE506AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F9F.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F9F.tmp
Size 479KB
SHA256 9fb9d7a5c3be90d63a29f6a306b91a2ced9a83053672a5edd43bb1369a6d1cd7
MD5 3a71d78c15f99e6fc0ed0d6591ccab93
SHA1 f7e4f664564ced7a2513b1d4220489e5fe5b2baa
SHA512 fb3fc7e99b0866bb3daed8a132eab442c73ddc50bfd1e455278bc676559ed3af7bbc5b636c5b7c4d913515aba92caf6bf2b17fc5923c221f15ce2c6d8f9bcc3c
SSDEEP 12288:bO4rfItL8HAd7ZeQJlXl8PWC1HwSq7+W75UO:bO4rQtGAdtd1+r1b7WVUO
TLSH
T136A4E12AB6818133D2A301754BE6E79AAB3E79700732A4C73BD4067D1F61AD1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download