792ba228d89cf3b50272ce82981d80ff4d1ec9649f1897affc1023a7a6cd4903

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260719-vbamnahw3s
SHA256 792ba228d89cf3b50272ce82981d80ff4d1ec9649f1897affc1023a7a6cd4903
MD5 927662b57eb736dd1e36ae30a4b98436
SHA1 a1d0400169f5aeca77c72e041a0810a16a440d67
SHA512 9c52e9fc2a121250c9d6d04e3525678589ac976d8cc17dc204c3d6a2f07444e0839f2c3d82d72206597592580beb5de7823c308af72f1594204aeeff85838749
SSDEEP 12288:qO4rfItL8HGAUMh04P8Vcm5HpvRhOqMo7bWmeEVGL:qO4rQtGGAUMG4P8VnHDYqMoumeEVGL
TLSH
T177A4F1267281C133D69312714BD6E796BA3E79740722A4C33BE8027E1F666E1D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1848	70A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1848	70A7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70A7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1848	4992	2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\70A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\70A7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe 592B4E633B376C89BB8FB1B4FC4E2E944BB6D194ABCCDFC3EF8256FCCD64AF7343ED6EDF291884A6A643163CA130F356ED098C69BDCCBD2558933038C5483B34
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

70A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\70A7.tmp
Size 468KB
SHA256 fd7117ffd98f04df331f35ecdbf63c27dc2ddc213a645f54e2f3c5fda8070b5b
MD5 95532888af6c03bad56c30fa2bbb89d1
SHA1 4d50d4a0495c58b249c518db269804638b4847f0
SHA512 fafb86e1086df9c4fdc428e03e28414960bdc9b8260b2512f148d0dd1b1e97359c8fa47f99cb42839de79dc91c4ad829d2bb5fd2d42bcf31511eba4e67823685
SSDEEP 12288:qO4rfItL8HGDdq5ONei+2hnjULJZ4+aNSV1T7bWmeEVGL:qO4rQtGGZq5fShEZ4+aNUTumeEVGL
TLSH
T15DA4E13A7641C133D69302714BE6DBAAAB3A75700326A4C37BD8463D2E316E1D77634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download