83f93e22aec292ffe7f829f12619fcbdd42734e97dcc0488ccda4b9ff7f308e2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260719-ty5wmsg19t
SHA256 83f93e22aec292ffe7f829f12619fcbdd42734e97dcc0488ccda4b9ff7f308e2
MD5 e25134a0f7332c06288a392f33a0dec4
SHA1 3bad44952461e099ca3f4c937b399cd57b922b92
SHA512 5ae10a98a489760d169ce92d3d87f499318b1b0a911e29ee6ff99d8fb33b36da74a27add522f33d8e10f96f30c7cee7105a1fa42a2e887b79381bfb697f1906f
SSDEEP 12288:qO4rfItL8HG3NEr7m0kdVvI6jQ7bWmeEVGL:qO4rQtGG3arK0aVtQumeEVGL
TLSH
T13FA4F12A7282C133D19302710BEADBA6663E7875473694C73BD4467E1F25AE1D33934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3536	16A0.tmp

Executes dropped EXE 1 IoCs

pid	Process
3536	16A0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16A0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3536	3792	2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Local\Temp\16A0.tmp
  "C:\Users\Admin\AppData\Local\Temp\16A0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe B206B08995FD42835575518520B98E6C98A2F710440ECE05A18E8C119C5D0B2B50FF7CEE0D887D69C9D1D82B535DC80F6C7DA3ED7C729927055CA4D4ACEE12F0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\16A0.tmp
Size 468KB
SHA256 799f8a68352f7d3305b84503a16dde2ec0baeb2ac6e0b32b3b360b43bae33f1d
MD5 bfef25500035cceea375749112f836cf
SHA1 87db981dea01655e28d1f8bab46c8dfa8ed12108
SHA512 1b61d2b203c202d136af5fe6898908f33507ba8331f5a0b1e16bc26b3bcab4e48795c556aebfd5a7df3b5004fd6be2bf50bcf3369ed187ca681d329ca26a5416
SSDEEP 12288:qO4rfItL8HGlDhjnAaXe6RChrhe0FkvyZoHa77bWmeEVGL:qO4rQtGGJaxhhLmyZoHUumeEVGL
TLSH
T19EA4E03A7281C233D69311711BD6DBAAAA3E75B11721A9C33BD8027D2F616D1D33934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download