2e93905ebd3f56df2649d8a0dc165ac88b44573fdfa0e85dc727a4bb9edbc00f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_b4c9c5d94d516566ab1f8c123ea7b0c4_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260718-hdblhsev3v
SHA256 2e93905ebd3f56df2649d8a0dc165ac88b44573fdfa0e85dc727a4bb9edbc00f
MD5 b4c9c5d94d516566ab1f8c123ea7b0c4
SHA1 9b77c342e0a0ddbe72a4a24e3c49284339e2781a
SHA512 64e3897b081baf39c9db2639dc0bb8c6162a884e22adf5498522c631940b3d3fb02ce19069fc89e682ada8fccc8045bbbab15c128c6acb37f9de8bb26fa27348
SSDEEP 12288:aO4rfItL8HRn8D2wWwe3Fpnr6/KyZUb/eDrR7K9wlsDpVFd:aO4rQtGRn9dwe3Fpnr6/Ko8Wx+9wlsDn
TLSH
T1E8A4E13972828233D29301741BEADBA6A73E74B5572694C327D8022E1F61AF1D776387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4584	ECFB.tmp

Executes dropped EXE 1 IoCs

pid	Process
4584	ECFB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_b4c9c5d94d516566ab1f8c123ea7b0c4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ECFB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4584	3056	2026-07-18_b4c9c5d94d516566ab1f8c123ea7b0c4_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-18_b4c9c5d94d516566ab1f8c123ea7b0c4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b4c9c5d94d516566ab1f8c123ea7b0c4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\ECFB.tmp
  "C:\Users\Admin\AppData\Local\Temp\ECFB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_b4c9c5d94d516566ab1f8c123ea7b0c4_elex_mafia_stealc_tofsee.exe F473AE47FBF65A5A6201CBBF87E0F529A517B8DDB77BF81BAF07DB9E772AC225A86B3685A406F6AF40EDDED796F3F70F0D064160C83ACFE25376924336758A96
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ECFB.tmp

Path C:\Users\Admin\AppData\Local\Temp\ECFB.tmp
Size 476KB
SHA256 fe06b07f2fd9b8d9fd845d51bce7d8da462ff34f1bdacf8749aee51aa8f0ce4d
MD5 e1cbea00f7add51318700359c560c6bc
SHA1 a7141db7ec293bd1a16fad7c46951278180182b5
SHA512 cb92534b79d75e45664303ca25b8a005f905f6b56ec605836c2703b40bff9a49909e46bb9575f413cdee126dce8410da507fe42f8a1ea6127eee347218062d64
SSDEEP 12288:aO4rfItL8HRMq3EXalKrhMYuSNQLy+pn7K9wlsDpVFd:aO4rQtGRWXaQrhcSNoRn+9wlsDpVFd
TLSH
T15CA4E02677418233D69302341BE6CBEAA63E79751726A0C37BD4027D2F616E1E73A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download