b1c7a5f1ef6657e14c73dd4e7c3f6a1aa74cde2c63669f45f88fe287b35d8295

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260720-wp8bhsct7v
SHA256 b1c7a5f1ef6657e14c73dd4e7c3f6a1aa74cde2c63669f45f88fe287b35d8295
MD5 194b5c6125809857c5cdb7d19501692c
SHA1 093fc19a2da0d3185f4af8b028e8822f36cc2d3a
SHA512 6beb55c5a1f7b4f8b7adacf81393a2bb11301b90872cbd6387a367c2bfb15065002cae6333489f06c276eab5242d4aa3b04d6ba9e7184f0f54d359fd6a5b92e1
SSDEEP 12288:Nb4bZudi79LoBLtrtGIT1susZNhnYTxUJ5rtA:Nb4bcdkLo/4IT1suaTE
TLSH
T159A4F1203581C037D5A301398FE6CB756A7E39A04B2668C73BE46BBD6EB02E1D635357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4008	23B0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4008	23B0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23B0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4008	548	2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\23B0.tmp
  "C:\Users\Admin\AppData\Local\Temp\23B0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe 85B69D5FD89F751983E8922C6D127197AFC685F82904605994E4AFE93C1ED950EFE3C130547716AB563D08B0ACCE0026330CC7262B979976B4681654433EED7A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\23B0.tmp
Size 444KB
SHA256 b7ed26bd7642862e2906ee73a8cb879a16fac7ba12eccf4b80ad57b155f4c918
MD5 6a459da46d7c6c6dfae03350a911cf68
SHA1 d110f99783a847bb7e73cf7953a1e76fa2b52b09
SHA512 ef718446ca40b75a17492467990bc838ebfd21c8f231a6411ced5ad9ce36b8a41349bddd6ee2421aa8ae2374d36e0afc0296c4edd2e08bbd2941e122a0d84d59
SSDEEP 12288:Nb4bZudi79L5PgN2d+O2BNJp81nyTuusY8xjA:Nb4bcdkLFg4cOxnyTL
TLSH
T15BA4E0243591C037D2A316384BF5CB76667E7DA14B22A8C337D46BAE6EB02E1D630357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download