f65963cfe2e79f43d112ce4fb8edfba7dc87334ab2494bc8f539e05249b55cb1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe
Size 435KB
Sample260718-gn53fac19t
SHA256 f65963cfe2e79f43d112ce4fb8edfba7dc87334ab2494bc8f539e05249b55cb1
MD5 e74d1b7ed17ed801a284bf876c770488
SHA1 568921368696597ebf7710355751a8473f7e6c25
SHA512 13d24895fc06c05c027608c2dff9da0ede50c61eef17e4cab565e3a44fd47dc09060b556dbd6507a4ee84a7de5c63f55685ae4eae7b11ab31a913c046eae712e
SSDEEP 12288:9W4ufepiqKQ1m0geI1VD49stsoTVnJG5TF4J:9W4ufepiqhmRs4soTVnI5h4
TLSH
T1CD94E1253186C037E1A309394BE5C766697D7DA44B26A8CB3BC02BAE6F742D1CB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3040	1CBA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3040	1CBA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1CBA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 3040	608	2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:608
- C:\Users\Admin\AppData\Local\Temp\1CBA.tmp
  "C:\Users\Admin\AppData\Local\Temp\1CBA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe 920A6DD6F06DE5167FB55C83D486A47F335DE4CA414945C4779D0A34DA359F57BC38235883F2F9929F6265403D94F4396508281B080E5CD0B03787A9AF3569FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1CBA.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CBA.tmp
Size 435KB
SHA256 9f77fe3a0a528266a3f60286dd56c6396e709f71e69ebe3433c6034ab66eea48
MD5 2992d3ead7d573c89bfdd39c8becedb0
SHA1 427c1ec20659ec68e94839ae78397e982a36a0ce
SHA512 f7f4db0dc76edde8cbe575cd1d23b4e078c6eedbd62c6ed932e8580e905263be0b27feabd5132af86dbb35a26bde51b425e90c61a311510706fd25355f2802e8
SSDEEP 12288:9W4ufepiqKQ1mdnF+ttO+017wrBhGhv2J:9W4ufepiqhmdF+ttODtwrms
TLSH
T19194E0257282C037E1A616358BE5CBA9557A7DA04B32A8C73BD027AE5F742C1DB3134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download