17c1ae6eedd2092c94df4c8f4d31c43fa6f36458d49aaeee44df49135f54c26c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_aebd29072869777e82fb9396815541b6_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260720-rlgbeaey3y
SHA256 17c1ae6eedd2092c94df4c8f4d31c43fa6f36458d49aaeee44df49135f54c26c
MD5 aebd29072869777e82fb9396815541b6
SHA1 59eda8828badcc42c583b5df3e45f594b47493e1
SHA512 0d653f20a936d6998ed6caf1493c2435e4768c0925b12928ceb7724251fdfd1ab9911deb9c6929e5e9ff080e922bcd70821fe12342fb484b5ae29f011490a985
SSDEEP 12288:fd4x+ePixnXQjsRTizvmVuBW3YVzsvT4J8wP:fd4x+ePixAjsRT9uc3YVzsLW8
TLSH
T1B294E0213182C03AE1E316354AE5CBA9993E7D711772A4C77BD42BAE9E702D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3684	64C0.tmp

Executes dropped EXE 1 IoCs

pid	Process
3684	64C0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_aebd29072869777e82fb9396815541b6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64C0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3684	3024	2026-07-20_aebd29072869777e82fb9396815541b6_elex_mafia_stealc_tofsee.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-07-20_aebd29072869777e82fb9396815541b6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_aebd29072869777e82fb9396815541b6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\64C0.tmp
  "C:\Users\Admin\AppData\Local\Temp\64C0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_aebd29072869777e82fb9396815541b6_elex_mafia_stealc_tofsee.exe 63B701C4475E9BB84D47332D6F95DDCE3EE45CC8514DD40138A8730FBF1B7D04440C9EFAA34DD59DF599FBD82D65F8A7F2E23B888D2612A9A8A56333CE49330E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\64C0.tmp
Size 435KB
SHA256 93ca55588832637df2291ebd7e401d0383249a7ddecda306f853a000110b3c3f
MD5 8a8c45b5fdbbf30cc75fd03098ffa5f0
SHA1 21b76905421b3a93775ab1d05ae37efc344eab08
SHA512 0261367d7d6c93d12a18ca65475ce0cf0f00a1cb5b4a04584d2648cf440451df5e2508c0aa3424b361a5eae834037526532f03a6a3f694a28b19c930efb2d3a5
SSDEEP 12288:fd4x+ePixnXQjnbO0NjdtQ87fEHkjWwP:fd4x+ePixAjnSW7vW
TLSH
T19F94E0303986C036E1A306384BE5CBA569797DB14B36A8C77BD02BAE5E741C1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download