ff9fb4a1e9e2195afce0d0825da22d458ff1f5ce729e264d8739289b394a9727

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-nbp9saat21
SHA256 ff9fb4a1e9e2195afce0d0825da22d458ff1f5ce729e264d8739289b394a9727
MD5 ce31acd2003ff98927e1d0ab747f1b3e
SHA1 abb40528d0b639d4b39b06d20b0c069d9b5913f8
SHA512 ebd67b3e6838ecdcc29231b914aaa8e30e2e2968fc992a3a3fe009b02d49a85ae0c49bee1e2e3dd6bd1031c09aa0c79cb474d57bdbab3605982bf4b77452193d
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStLS41UzVjW/4ryqA/TC/Dmn2HSQ7xMRS+GSy:Nb4bZudi79LMnwHA/TC/1/7+RSSA0a
TLSH
T1BFA4E0203582C037D29716744AE6C7F5663A7CB15F62A8D73B943B6D2EB02E2DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
952	1E9F.tmp

Executes dropped EXE 1 IoCs

pid	Process
952	1E9F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E9F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 952	4128	2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\1E9F.tmp
  "C:\Users\Admin\AppData\Local\Temp\1E9F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe 9232D5F8FEC9C68913C474475B5821C2A365E2EE79DADE718BE87C0B778B3D9B2F3771CCC890FB60FF28C80160CB28A4050549678A63BC886AC37EC4F6BA9905
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E9F.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E9F.tmp
Size 473KB
SHA256 1df691eeb328ae14893df9001d5c8cc2d52fbac93f2340edb60b51d03eb554b3
MD5 dddd9799aebcfb7b7554b7d36f282fa3
SHA1 f3b466701f1695bdae02e8eae511052cc930019e
SHA512 875299c911643d4d98ae79ebe6d0112887133f13b745076174815df743c127884f227c27b08f36cec5dace49edf810c13e93a4784d072933f096cc27db2a17b8
SSDEEP 12288:Nb4bZudi79LV+z0qBqYldTSe9cnnBLpNA0a:Nb4bcdkLVe0qBbonBLpc
TLSH
T1E0A4E0247692C037E2A716344AE9C7B4657E7DA14F3568CB3B9037AD2EB02E1DA35343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download