1bc412b7c9b00f100366030b511cbdbe28cbf363bc13737cae9cfc5bdc05c2c2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260720-qmapksbw3m
SHA256 1bc412b7c9b00f100366030b511cbdbe28cbf363bc13737cae9cfc5bdc05c2c2
MD5 1a9a3a0f074db4c24d3159ac5e163a25
SHA1 3e28f4322fd050ec94fa7652269686e6dd74c43a
SHA512 c23e3855c4d1fd7a0a4bc174b3f939fde7ab80a696df973369daa6d24a577f5e205fa024f5a9c8e833a7c2cdba8c4ee026fa51eac8695d279efc879ab2cd94a8
SSDEEP 12288:qO4rfItL8HGZ852M6p8ehaBUk4gOt7bWmeEVGL:qO4rQtGGeb6p8ehaBUxumeEVGL
TLSH
T107A4E12A7241C133D29302754BE6DBAAA73E75B5432694C37BE4427D2F612E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4432	53B9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4432	53B9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4432	2648	2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\53B9.tmp
  "C:\Users\Admin\AppData\Local\Temp\53B9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe C13BEBAC34AFC95E40D5245F441229F845B02B1302AB6D9EA43A29413F563463A8740A951F8CEBF07E15A3FF24487E91493BD215F42CB9580CA1844B43D1282C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\53B9.tmp
Size 468KB
SHA256 a2813f77abb3e79ef9546cf24eb144e143665d8ba8e957efe62e089bae696c30
MD5 f5bd8c7cefbc0fa524d42b4cc7a144f7
SHA1 375027eb16bdbd4742e99c01ad4ded39f6d072e2
SHA512 8856d609e58b725c66f24617df17de3c9b62bb04f648c2a3de32b85f5ea22d47238c89a04a4da8a141a4437434f1a175feb1e63052ee54201e46d9c8d5792412
SSDEEP 12288:qO4rfItL8HGbrLcfEpvmo2wlTv+Nb7mt7zJfkWdx7bWmeEVGL:qO4rQtGGbrLcfivmo2wlTCmFJsWdxumM
TLSH
T18AA4E1267242C133D29302714BEADBAAA63E79B1032598C377D8067D1FA17E1D73635B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download