6a7aae7303c33396e30036ba7e08dd9c7d4a3bfcd49594bfa9a84f9210a918e0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe
Size 981KB
Sample260730-2ev64agm2w
SHA256 6a7aae7303c33396e30036ba7e08dd9c7d4a3bfcd49594bfa9a84f9210a918e0
MD5 61372590e988fc45f9c0224613151e8e
SHA1 8e7cc1ebddee92996446a7a1ecb7849fc7c852ca
SHA512 0ed63bc784e0c113fd0afdd2de88fe047438003de0de565647e3d86aefd71c0818f46fbcce15bc38ff859e6fcc81ae33b82c6d29087c9a890992d4f27d80f6b7
SSDEEP 12288:FvfTNJw8OLcroCiCOPcCiMKJLZmUAMsNfCL33otGQI+Dt/Xf5xbtJCG0F0S:FXTo8eXEcSLZmym833ofI+Xf5xbPh
TLSH
T1E5250111B9808076D5D629314EF987120ABB3EA647E278C777C47B053E73DC1A7392AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	5A12.tmp

Executes dropped EXE 2 IoCs

pid	Process
3284	5A12.tmp
4484	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A12.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3284	5A12.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3284	2596	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe	84
PID 3284 wrote to memory of 4484	3284	5A12.tmp	86

C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\5A12.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A12.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe 6AD55B46A4C1D4E92E499E31F68C76857E211630B3E0A8349733674E266FF40F4A81D243E7825845E7BBCFE4A7968AA5728E3FFCD9EC0D0E4DCE29BA3EC1263B
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE
Size 1.4MB
SHA256 98987578c600dd5a8789ceff6dd031e11807b5b05eececc0566feee1485e6ca7
MD5 2300108f6605bdcd33dc98c7a321671d
SHA1 3d77097930b85bba06e5ed9f37488f6d099ad63c
SHA512 1dd276c53b2917b1c0bec26d6670a86988d2893959df86e014c2ce8b3d0230896f7c8789e072f5ee44f4b0e0754a9aa643e42e3ae5c8167fc74a24815b2c837c
SSDEEP 24576:2LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQTZ2:yZmQyaJ1ZmFcqi+SRAG+X
TLSH
T109655BC3F90181D8FCA92D754C3E5E401AA13FABA6C43C1A609E770639B3C93566B95F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A12.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A12.tmp
Size 981KB
SHA256 2e9bc3d5dd1b9509a7f3d1046b4f0eb257bf9cc51e9d2269724d4f9d3bbcb83c
MD5 018851286c4a9f7e495ffaf8b095524d
SHA1 45e06d3fe5a1ccd665cd905b49ea21706e304f01
SHA512 188bddc72c79f04d0d1a22eeb2904b897f0179b3bc73d30e00e17f2a6f75309e63bde2fdaaec930a01215fbff9b64c0b681bf6c1465785b4f6c804c373cac45f
SSDEEP 24576:FXTo8tudetjrjMIppmRLZmym833ofI+Xf5xbPh:FXTo8tudelFEZmym8SPpP
TLSH
T1E8250111BA418076D1DA29320EF6C7120A7A3EA647E678C7A7C47B153D72CD1E33929F
MD5 SHA1 SHA512 SSDEEP TLSH