5cdc6c27bcdafcdf935d06c9042dee78e8440cf4a53ec50d050f2486c074bfa0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260727-rd6lbstgld
SHA256 5cdc6c27bcdafcdf935d06c9042dee78e8440cf4a53ec50d050f2486c074bfa0
MD5 e7adea26bae94f4b49c6335f19402ac5
SHA1 5d0c1578824df71bfd557c456a2471ece21f1396
SHA512 ccd7275de67c73f6b56e8974ed5e35cc2f38edb3510dcead0390b5148ff7cbb4e60507fa836c8d11d9f3d8295f9ca410bf5ba1f5249ea2329bab7ec45d25efc8
SSDEEP 12288:Nb4bZudi79LEPEzLKhQcmJCzcK/wXrxHDJwxj5UA:Nb4bcdkLZLJMzE1wd
TLSH
T18CA4F1243591C037D2A715344FE6DB65A67E39A10B2268C737D42BAD6EB02E2EB31353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2024	1633.tmp

Executes dropped EXE 1 IoCs

pid	Process
2024	1633.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1633.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2024	1304	2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\1633.tmp
  "C:\Users\Admin\AppData\Local\Temp\1633.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe 342A8C5F99C1A5942EDD311A0CFC3C5AC083E2BC8E64B8D31A543E6A01CE5D5D252CE6F93E8497C1CD35D5C0F97AC9479BFB991DC47E5C77114CFE64627D276C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1633.tmp

Path C:\Users\Admin\AppData\Local\Temp\1633.tmp
Size 444KB
SHA256 0ba341845a358160e09a31ffcc615e5f09c008b30eacd571f0b3c16220f06c0f
MD5 b298837a303f343f2b5ded866c839890
SHA1 e5afafa720a5efa7ada02b020b94d131c268b2bd
SHA512 be662d21f79159de2b622680b78ed93d9bd234423989cdc20d2408756c9f84584f4a67d7c794a5569e789bd0e51262e855c5218e8b747d0975d6f70329d247a9
SSDEEP 12288:Nb4bZudi79LmbGS6nJQBHlAN11WNAcVBr7hA:Nb4bcdkLmKJVdWN
TLSH
T1D8A4E0243582C037E19316384BE6CB7A697979A14B2568CB3BD42BBD5EB03D2E730347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download