823600f5ba4e6a1b386222595bb77fd7ef42d3e7f5a4e62bb87b562d4effcdbe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260727-cfh6gsfr21
SHA256 823600f5ba4e6a1b386222595bb77fd7ef42d3e7f5a4e62bb87b562d4effcdbe
MD5 8e2a861caf863804b460e9de9f487006
SHA1 fa191eafb76d7fd7bc9d64aa5e5811776b04c37d
SHA512 002f44ef9401550cad35e6a011a0c4f816c59eaddd6e68cf2c90665a46d9a1452265ed48dd43f0b549dab8ff380dcfc31f650567161c28fa330c78710aa77542
SSDEEP 12288:fd4x+ePixnXQjonQjtnsLQZMNHrIW+pUnwP:fd4x+ePixAjNsLQZMGWEO
TLSH
T12794E1213686C036E1A706384BE5DBA9597E7D704B32A4C73BC42BAA6F751C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4388	3004.tmp

Executes dropped EXE 1 IoCs

pid	Process
4388	3004.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3004.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4388	3264	2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\3004.tmp
  "C:\Users\Admin\AppData\Local\Temp\3004.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe B3D70C73747191248EAEBBBA85405CABB67B90EAFF2770FEADDE07094CAFB420AA626C1CAB8146A34040BE4728D6D6FA7C45929E870E53DEABBE422527F05A27
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3004.tmp

Path C:\Users\Admin\AppData\Local\Temp\3004.tmp
Size 435KB
SHA256 ae1e8aca7846b672c86154d4b2a5bbb439781a817ba28577956feff3ab073a14
MD5 448c0bee333c74d9e754c9e21a98adae
SHA1 aee64ff375eca3918d7fdd9b22e44409e03418b1
SHA512 30b9e2b333e179ebea859ba190a0964819355d842f4b436b8d673a7e01f92f7669f948dc4dba60d9c381f68b7439c6c0306f36ef5ec88834d90363f94ef6d344
SSDEEP 12288:fd4x+ePixnXQj2VEoOmz+dnQPdidPHkwwP:fd4x+ePixAjk3dzEnhX
TLSH
T13794E0253586C036E1A316384BE5CB6959397DB50B72A8C33BD42BAE6FB42C1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download