3c9a5ff027834d32da0fc31ebd9645a37d226533eb83ade60d470cdcec87361f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260720-vn5cssay4z
SHA256 3c9a5ff027834d32da0fc31ebd9645a37d226533eb83ade60d470cdcec87361f
MD5 b0763d3db02b8d8515d3161cda9a255b
SHA1 dc9c23adb26487d40f0b917bb95f476adde59c95
SHA512 e7949ff81f6e3cf0b7c2e141023aadd896a0b0577009533678cf42d66bb571edc30abc6978e1c447608f3fea15f7aa63cf7b79f9f75f526547f4e3b6e8ca460a
SSDEEP 12288:qO4rfItL8HG/zEV30RTavfV1EApbT1qoL9oGvVPKs7bWmeEVGL:qO4rQtGG/zi6TmuybR16GvVPKsumeEV2
TLSH
T16BA4E036B281C133D19302754BDADBAABA3E78B54326A4C37BD402BD1E616D1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4972	F86A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4972	F86A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F86A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4972	3860	2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\F86A.tmp
  "C:\Users\Admin\AppData\Local\Temp\F86A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe A7C8D7252D7725401BCE092D76A9939DF0D569EF0E5B4AD8CEFDCFA5BD5A8B7BDB770A9E8DCFB38A0D05DAAAC028F042534208743DB778EEB9D10163AF299BAD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F86A.tmp

Path C:\Users\Admin\AppData\Local\Temp\F86A.tmp
Size 468KB
SHA256 2e6ca9960390e5323cf0be5406cbfbaa8a35adefae5bddade0fb05708fba81bd
MD5 b63005a757014cf0955e843fe974969c
SHA1 d539354187bad0460e54fa8d0c3ccfb9113362f4
SHA512 eb49df6af96aaecb0048715ddd7cc14f9dc0e4bfd94a598cd0cf54fda8e69ced7651ae282effca66ed1c243f10b834a3d2e751a22c9f7423ecdb83da0477cdd3
SSDEEP 12288:qO4rfItL8HGgcIWHlVxPw1cV9P/W+7bWmeEVGL:qO4rQtGGgWFaahumeEVGL
TLSH
T127A4F12A7241C133E29312755FEADBA7A63E75B00725A8C33794427E1F61AE1D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download