d32914effa4be0398e275d0968da2ea9dc40d77a47f290d0e7004f0c9c24b0b9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260718-maxrssbt6y
SHA256 d32914effa4be0398e275d0968da2ea9dc40d77a47f290d0e7004f0c9c24b0b9
MD5 da39478329362aa2000c9d490a3823bf
SHA1 a9d821fe2e43b4b56c3348f166bac283160adbe7
SHA512 0b88b959edfd5bf229bc195217a370b76d28fd50ad0e5eff2f3070884b79b689ccf654500e1d0b6d2a274a9d98dc3bdb9e30464e591a014d587e851323e2a471
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYXfj8QyREfX2fIa6H4DId1qmvDUruqNU1lMa:Wq4w/ekieZgU6s8ntIBN1xbuNmlMa
TLSH
T1CDA4DF217586C037E1A702348AE5DABA1A7A7DB14F71A4C73BD437AD6E702D1DA3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5600	3FD3.tmp

Executes dropped EXE 1 IoCs

pid	Process
5600	3FD3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3FD3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 5600	956	2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\3FD3.tmp
  "C:\Users\Admin\AppData\Local\Temp\3FD3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe 44BC41EEDC99C39D90819BA84867442ABAB3DB8D1FEA4AAEB9F8C2DF2F4ACF5483DB0E1959692445B4D541DE6213820606F8C3F0ED226EEC215B1F9029A37BB0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\3FD3.tmp
Size 443KB
SHA256 f7393ded4c1322b6b4f665a76336154ba89dc3001b411c82e813ded3e72b7c21
MD5 6055cc47a4af2c2ed4c086d928d05bf2
SHA1 2a92cf79b50d07130e7d01ab01235a61d323fe24
SHA512 edb212393908f2e6fbc1c99308761074d001acf55f4c8b5ebc2b502b1051fa33173706a0b138879a1a3f1694099a963af6336e3e587b23d99e844973b266cb4d
SSDEEP 12288:Wq4w/ekieZgU6iwrIcNFCfMMLnytWKNlMa:Wq4w/ekieH6iwrdQANP
TLSH
T1E6A4E0213686C037E1A7063486E4CBBA5A397D615F72A4C73BD43BAE6E706D1CA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download