a547ccbdefe77d7403808f3e816a27b3ac658c55ffdb29b3c6fdb321583d1685

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260720-rx4abaft3x
SHA256 a547ccbdefe77d7403808f3e816a27b3ac658c55ffdb29b3c6fdb321583d1685
MD5 536bd606b5293a7e0c6bc3626cd3fe2f
SHA1 d8bccda269be20c04ee566b35f641798e9b2dcf4
SHA512 942e9098b0b8dc819287a61398235eafc13e7d024245c592d17633d41f8ad9aa9e398cbd72b4f83f6932c6c7fca53b5b5bec4ab939c16d8e8f60e37c75a14740
SSDEEP 12288:bO4rfItL8HAdFEGG3hg2CJdP7mLXnlGXNHot75UO:bO4rQtGA7RG3HWTmLXlGXutVUO
TLSH
T16CA4F126B681C133E29302750BE6D7AAB73E39B50726A4C33BD4026D1F616E1D73934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3872	3CE5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3872	3CE5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CE5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3872	2652	2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\3CE5.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CE5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe 08490EBC84789BC4175DC79F8A763600F198CF14C3472EB00785F8AD70E0B715BEA9C859D875F8190E2CAD69752B10250383C21318F67A14270C082C682C299F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CE5.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CE5.tmp
Size 479KB
SHA256 b2422c2b650e2ca19174cee34af961b6fa4a3522a88f5cb1695323f853d1ce7f
MD5 39e0f3c47a70f94f16d5d3c4b3ad99f3
SHA1 f78dc59a988c83b966e5e851e2657fcef3019483
SHA512 d82c95ad7ef732f4a636020479c6d2e1c8be4400646be07fcc8db391aa6dbd0bc40b6c16cbe5ce93fcad9d08f599f8056673b8a1ca097257f7f07ba51efc10b1
SSDEEP 12288:bO4rfItL8HA4Enew8Ter6gCsXN03RaY8UiRB7QgQc75UO:bO4rQtGAixTer6l3V8UiQgJVUO
TLSH
T1CCA4F12A7281C133D29302751BDBABAAA73E75714725A4C73BA4027D2F517E1C73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download