56c159ca9dbef9a99ed29cdf8643624d7feaeb1375cacb2eecde82938656d811

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_ffba7ee2d8af59f25076c373f6139986_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260727-fm3egswamd
SHA256 56c159ca9dbef9a99ed29cdf8643624d7feaeb1375cacb2eecde82938656d811
MD5 ffba7ee2d8af59f25076c373f6139986
SHA1 18f4cc7f132129adc1ba447c8d030dc8f5929838
SHA512 2788a92f90c6c6437525b5badbb74a9786dca6ab827452f17f06b009b754ff092ea4fbf38b451e868bc70f77db9a3427c74e130d4e3a0a611c7972adabff13c3
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFx4bdEnVZ9iSf+yGBEVpDVHNOub831YqH:gZLolhNVyEt4tf+LuZNOuiCqH
TLSH
T11794D028B2C1C036D19301358AEADB75553A7EA15B2164CBB7D83B7D2F713D1AA3630B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1968	1CCA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1968	1CCA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_ffba7ee2d8af59f25076c373f6139986_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1CCA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1968	1CCA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1968	4184	2026-07-27_ffba7ee2d8af59f25076c373f6139986_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-27_ffba7ee2d8af59f25076c373f6139986_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ffba7ee2d8af59f25076c373f6139986_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\1CCA.tmp
  "C:\Users\Admin\AppData\Local\Temp\1CCA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-27_ffba7ee2d8af59f25076c373f6139986_elex_mafia_stealc_tofsee.exe 3CCE5ED6B8C7357547AABF09B6FA96F91E1B3563AF0952294974861043163341705002C557AEDF3CA0CE0EC4EE1F389292226E42010C4230F84472FD5832B171
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1CCA.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CCA.tmp
Size 411KB
SHA256 057c7ce7f964ef61e9fa6e5c8892125e5380fe2a860f7c515047079fed1f582b
MD5 8e26dfa21acb470d8b7f5fc8c40812f7
SHA1 f035dc2ae80eb21cb393b16767e67b9e8320b44d
SHA512 6fa4e6db6e0fee4da577f17e79e7f0c6d4d865b31ffc15407f3172843aeb2583b101ff61e2f008746c2e0505f14847050504c750dc899467f620d0c5f65b4f54
SSDEEP 12288:gZLolhNVyEhQwhlpuzT8nN07/9Sef/n/hqH:gZqhOEhQwh+zT8NI0u/
TLSH
T14694DF257281C036E18704314BF6E772193A7DB15B6268CBB3D8367E1E713E1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads