d3e119a15117cc742d49fe5a1d111d1337854e406b45fdc2e5f5b1b6879b6134

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e4aa6ef9ad60d2fb860d9ad248dc8554_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260727-pygrlaer4y
SHA256 d3e119a15117cc742d49fe5a1d111d1337854e406b45fdc2e5f5b1b6879b6134
MD5 e4aa6ef9ad60d2fb860d9ad248dc8554
SHA1 87a53ec53817701d6727496676ff12b2c5cb09fb
SHA512 3d57be393ccd5eeb08494259bcb1e46ee6c62781b8abe69e684a946dc4d4a2b1ae0866d847d85ea15b4677b18716f26eed0243c90f2609d2fb38cdc63cf28427
SSDEEP 12288:3O4rfItL8HPdAEHrkh9cScJLIXtiLi7rKxUYXhW:3O4rQtGPdYcScJLI53KxUYXhW
TLSH
T118B4F12A76818233D293027157DB9BD6A63EB9B11336D0D337E8427D1F61AE1D33A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
512	61E2.tmp

Executes dropped EXE 1 IoCs

pid	Process
512	61E2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61E2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e4aa6ef9ad60d2fb860d9ad248dc8554_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 512	1364	2026-07-27_e4aa6ef9ad60d2fb860d9ad248dc8554_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e4aa6ef9ad60d2fb860d9ad248dc8554_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e4aa6ef9ad60d2fb860d9ad248dc8554_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\61E2.tmp
  "C:\Users\Admin\AppData\Local\Temp\61E2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_e4aa6ef9ad60d2fb860d9ad248dc8554_elex_mafia_stealc_tofsee.exe FADF540922C3F1F8B81FD53ACA68DB815E71E688E09D33AACBBDF5709EDFA93C88FD29AF20F2F88BDAA3A82CF054F5C7D9BE037EE37E5DD1F74E7A1ED14C2CD6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

61E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\61E2.tmp
Size 486KB
SHA256 b318e6b513214f0cabef49ae6a9331b0511475b4bf6a3994ce7c1dc5a580050b
MD5 10a072065556ec7c05c8ebe2acbf6083
SHA1 c874fd63f666cb6f9e072af008f3609d171ad0b9
SHA512 597a69eeb85cc394630d709b9bc982ce6a7b2694d7d3e066a412f25ad78da12d2c5046e309fc686f95db9b98c4984a3d7b91c34439b9e3a76fbcdc3259447a6a
SSDEEP 12288:3O4rfItL8HP9qX8FxSzCEuhfOumTfWSCZADw7rKxUYXhW:3O4rQtGP9qD2jhWuIfWp+w3KxUYXhW
TLSH
T1A3B4F12672818233D2D302341BEADBD6763E7971172694D33BD8426D1FA1AE2D736387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download