b1874433325b8e61c9d1270c5750403ed0d9f8669ff76a453a1c4bb7bf1edb14

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260727-pd2w2aag52
SHA256 b1874433325b8e61c9d1270c5750403ed0d9f8669ff76a453a1c4bb7bf1edb14
MD5 5c717530b8658dba1b763134ad79c3df
SHA1 8bdef55b8abf84a2a06d23ef2b983d2f03e7c2bc
SHA512 1d1b9d4e5405cdc3ea7456db20170a00be2c98e86c6de24390b8aa31d7b72c9111bf0f46589321f8a83a96dbfe4a9fe6d63822ab76fe150d9d4d351a91b645df
SSDEEP 12288:gZLolhNVyElYIRwzDDdclUZLQ9YBHoDkSqHg:gZqhOEuRzDDylUW97/
TLSH
T1DD94DF2476C1C032D19301354BBAD772253A7DB15B62A4CBB7E8377E1EB12D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2820	FEF1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2820	FEF1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FEF1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2820	FEF1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 2820	5228	2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Users\Admin\AppData\Local\Temp\FEF1.tmp
  "C:\Users\Admin\AppData\Local\Temp\FEF1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe 7240E1C78E4C32B3298F3FE307292554BCFE841B9CF3BFBCEC8B186885E861E4AFF6B11F9D58CC10F239AE583CE05E76A5BA3413E0FA0360B3B156ABEA4D226D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FEF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\FEF1.tmp
Size 413KB
SHA256 5b37ead1197f71d7555c0e24470e2dc34b8d2ab10169cf33222d22940b0c5744
MD5 2f47ac6d3c0e92fa9ba0d7be57b02fd5
SHA1 28537644c32b75940440b4a8daa80c59b2c8fac7
SHA512 edeafceb21fa63a0b074050ee8527feee203c5935abec6013d0d90b0616b3386b69fd3c5906430975a60c0f19e782688934137307f7af0f2bcda961158fbd1e6
SSDEEP 12288:gZLolhNVyEJguyoOa6mfPrWkyN+NbVSRqHg:gZqhOEyfaNf3yNsbVSB
TLSH
T1B794DF29B281C036D19305304BB6E736253A7DB15B6264CBB7D43B7E2E703D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads