2546375ae8b5139d48b6015d23e14a1b049a98e6b46b7a1b0e74dadeec40bcdb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260724-mdds4acl2t
SHA256 2546375ae8b5139d48b6015d23e14a1b049a98e6b46b7a1b0e74dadeec40bcdb
MD5 4a2b2342419628458bb038050f16e434
SHA1 2bdbe401d1104d044a28387bf634f5a5a6acec32
SHA512 5fc568a4dea569b53b9c8824fcd5bd004f837d52e52c499e81a30fef8f4768aa7d1053e79e0aa0e0ce8d23c089d0e2a6fdf4af2b233382c50d96b9d549e6ed12
SSDEEP 12288:Z594+AcL4tBekiuKzErZNajzQjTzz6dCVGS6IN9hQJl:BL4tBekiuVrLZjvCm0S9Q
TLSH
T10694F0203482C037D29B12384BF5CB7A627F79B64B6668CB7BD417AD5EA42D1E630347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4780	8604.tmp

Executes dropped EXE 1 IoCs

pid	Process
4780	8604.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8604.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4780	1664	2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\8604.tmp
  "C:\Users\Admin\AppData\Local\Temp\8604.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe 6B4CBB30563C1148473A545FEBE4C14EC6CDB2DF4D75B0A116913B8408CCF2BEEF92C62AB64D58032F5EF457D553DBE8E2319143213460D4482CF33FAF060806
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8604.tmp

Path C:\Users\Admin\AppData\Local\Temp\8604.tmp
Size 428KB
SHA256 09c43eb6ca706972656952d38347ce1c22ac8498891820a40fb6ade6a9f763e3
MD5 ac2251ac0ee2ffee5bffe203364cc997
SHA1 971d28e3b5e2108ba57a1e67177c2bcfe723d5e2
SHA512 941e26df548f42236f40e18ad14363206c53e8f4a0963716501995c6463d5853fa37dfc14de7fcd5538f6fb6b238da7ea1e2d21cae909c06e4d437a94f4d08aa
SSDEEP 12288:Z594+AcL4tBekiuKzErStDioXsF/8X2KNSc3CYrl:BL4tBekiuVrmDiH8gc3Cg
TLSH
T12494F13135C2C037E29A15384BF0C76A56BE79B60725A4CB3BD01BBD5EA46D2DA3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download