87f802a95c55710bd559cd1ee7690a7c25fc7b6ff59aa4e94188f84bb3f3c708

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260728-p8a2sshd39
SHA256 87f802a95c55710bd559cd1ee7690a7c25fc7b6ff59aa4e94188f84bb3f3c708
MD5 5225f0492e9fbadbc389ee7e0b79a687
SHA1 1c3b061086bcea70391574d0d4ba873da7d918a4
SHA512 f521f3419fc4389919942a933c92585c9ca323da637417579d4f141662caa9a0e516033e51a711cea6b8516edbe318506a036cdd11dad1a8d60b962034053f06
SSDEEP 12288:Nb4bZudi79LUFAgpYBZ9oqzxyC0Ij4h9x1JLBnlzP6aA:Nb4bcdkLUFAGqkR93Rh9
TLSH
T1D3A4F0243181C037E25306354FF6C772697A38A14B2668C73BD46BBE6EB02E1EA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4192	BBE8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4192	BBE8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBE8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4192	4688	2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\BBE8.tmp
  "C:\Users\Admin\AppData\Local\Temp\BBE8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe 4458D0F1C8D5B2063634EADC2DE5AD609DE5B68425B6ADD9F9FD7D24B71D354E12388B9E330D687D874CF8D86C6BD080AC433B1A392BB387FB23DA740DE8ADB7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BBE8.tmp

Path C:\Users\Admin\AppData\Local\Temp\BBE8.tmp
Size 444KB
SHA256 544f3490493d78365a28532fd822faaccceb4160ffb6bd95402509b4127a6e74
MD5 457494cce62afef9cc45b944cecfb7c7
SHA1 330af73bcf8165dd7d0970018df08d27c254e888
SHA512 abb5847031ca9c1fe2bf381ca05736bf0d4ee2d5363fe2cb192f450661b4f1c891470fd95570de017aa9944b806b4ebc5de7123c3b41762b8fe132fc6a9a2acc
SSDEEP 12288:Nb4bZudi79LuAEz7zk+hHzPgtALaGXYA:Nb4bcdkLuHMMH8tALaGX
TLSH
T11BA4F1253481C037E29716384FE6CB76AA7E79614B2668C73BD01BAD6EB02E1D730357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download