0a21c3d0878de2d1224869c2530a11ed242ddcd6c3afed93fd0fcd5dde8601e0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260720-nw7dssbs2x
SHA256 0a21c3d0878de2d1224869c2530a11ed242ddcd6c3afed93fd0fcd5dde8601e0
MD5 5f394dc08999af189c4f016dcafa0265
SHA1 3c858aa32d3d8c632bfc563d6b802fef70b6b708
SHA512 ddb03e343ccb49c8e5675aceca86500bfbbedf569884d8d655046d6c5d31526b74b8eb710ddee6530171951dcc60eef863a31ac2fc08ea82ae756cd4b8cff896
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStOaGWvRtltU16cJeLabbXHfrrqlmEA+a6KAT:Nb4bZudi79LZYbosueLi7DrhEA+yA
TLSH
T1E0A4E0203181C037D2A315394BF6CB76A63E39A14B6568C73BC46BAD6EB43D2E635347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2000	2B32.tmp

Executes dropped EXE 1 IoCs

pid	Process
2000	2B32.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2B32.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2000	4304	2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\2B32.tmp
  "C:\Users\Admin\AppData\Local\Temp\2B32.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe 00916D5AB843CA02298C9277CD447C5FB9C197EECA99D3EE1E91BF4D1205244C1A3FFAD971920F3C72F2CE1B2ACE1CEA65F3509B5ABF078327C621CF4872E6B9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2B32.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B32.tmp
Size 444KB
SHA256 037040ce7dad6ded521f2562aa4e163775ce3d621386d9c224897949c212c87d
MD5 f654893aeedb0b70383560355844775b
SHA1 d1377eb449cab3c0b30be35f2fb9a8f293a46d25
SHA512 becfddffe5e543513c378e5e346f421c05f9dac136a95e554dbc8c177b59289d7686b2195ad78b9c2bcf310989aceb3d73a1553b202d429224f871e0738d276f
SSDEEP 12288:Nb4bZudi79LI/4C2h5WVq2zwnsv9GP/rIFq1GdA:Nb4bcdkLI/4zb6R/GP/H
TLSH
T17FA4F1243181C037E29711344BF5DB62A93E7DB19B26A8CB3BD06B6E1EB12E1D635347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download