4f668bc42ee8760b3a571b8a099e6cab042366a14e243de62f9144a11eb2d010

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260723-pygrlaygra
SHA256 4f668bc42ee8760b3a571b8a099e6cab042366a14e243de62f9144a11eb2d010
MD5 d863202124bac66c551d1342b932c184
SHA1 2465fd9881b9a1f1955bf7cb6cbd86d802ac59a8
SHA512 42bee53f9c1cacb50e65c100abfb3f7735a57e3fff3a09b379bca8b0fbd53edbabf81f21b78931cb3c02b27a7fdb61209f195dca5506fb906c8ace842bcbfb95
SSDEEP 12288:Z594+AcL4tBekiuKzErNrR59SJpQaFIenWD7zIxtl:BL4tBekiuVrlRRaKvPzIxt
TLSH
T17794F1353186C037D6A712394BE1C76A197E79B60B26A8C73BC42B7D5EA02D1D73438B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5020	4159.tmp

Executes dropped EXE 1 IoCs

pid	Process
5020	4159.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4159.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5020	4860	2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\4159.tmp
  "C:\Users\Admin\AppData\Local\Temp\4159.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe D3933C056E10798E4B4AE967B76D95CE8ACC8ADD603A2B699279353237874817CD5D6A50ED357E489ED67109EC49DDD0EBB44678793C0AC6B347A8E3ADF2B17F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4159.tmp

Path C:\Users\Admin\AppData\Local\Temp\4159.tmp
Size 428KB
SHA256 d1d775d132020cec49beaded9a6aa1a13e90c75a3dd0d355aa3060e574e04d4c
MD5 58c20180a5f0c0269f56bfdc4d0a50a1
SHA1 c2b6f00bc6da0052932b7ffb5f9621c2e1ac0497
SHA512 4e814f9598a8c4d2d75082aa4eddb149a1cbb314eb8c9dbeb6397b758ad2aed7430b7e341e57c0a93f6b28b8fbeafb9d6ade1eeda1b1f7409334296acea947b6
SSDEEP 12288:Z594+AcL4tBekiuKzErPeIG6VYdFolp0elgvvhwcm1WSJF2mM+ZPl:BL4tBekiuVrVG6AGlymgvJwc4fM+t
TLSH
T19694F1353092C033E69711384FE5CBA659BAB9F28B26A4C73BD41BBD5E642D2D234347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download