e2c2f415bffc3e1cfb0c8250122815f13adbe8ef439f5fe304835bf08f0c2fed

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe
Size 981KB
Sample260730-2h3eksydle
SHA256 e2c2f415bffc3e1cfb0c8250122815f13adbe8ef439f5fe304835bf08f0c2fed
MD5 3e686fc92a0f2794b835312069f1d21c
SHA1 1f3f61a121268df65cd29c9a5436b29e4d8e7230
SHA512 c09e3bde93551ff788f6623b3de7d4dae9ef934f9805dcbc41b609b9ca04d34e8375f1339c6680e51acc0dbb95f31ce1b7c4362d323c9ab0a189814b34d6241e
SSDEEP 24576:FXTo8VZE0p0sorDbaLZmym833ofI+Xf5xbPh:FXTo8LE0psDCZmym8SPpP
TLSH
T1C9250111F9808076D1DA29360EF987120A7A3EA647E674C777C47B193E72CD1A33936E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	7AF7.tmp

Executes dropped EXE 2 IoCs

pid	Process
3364	7AF7.tmp
4476	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7AF7.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3364	7AF7.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3364	2192	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe	85
PID 3364 wrote to memory of 4476	3364	7AF7.tmp	86

C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\7AF7.tmp
  "C:\Users\Admin\AppData\Local\Temp\7AF7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe 22351346B827D13C6690D5A346ECFF1E5A1DFE64110AADFA4F795A6333ACF27CE310535E6339F904AF7D6CFA473C4A93B66A55B43D98D1C6F28830181E980F6B
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE
Size 1.4MB
SHA256 98987578c600dd5a8789ceff6dd031e11807b5b05eececc0566feee1485e6ca7
MD5 2300108f6605bdcd33dc98c7a321671d
SHA1 3d77097930b85bba06e5ed9f37488f6d099ad63c
SHA512 1dd276c53b2917b1c0bec26d6670a86988d2893959df86e014c2ce8b3d0230896f7c8789e072f5ee44f4b0e0754a9aa643e42e3ae5c8167fc74a24815b2c837c
SSDEEP 24576:2LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQTZ2:yZmQyaJ1ZmFcqi+SRAG+X
TLSH
T109655BC3F90181D8FCA92D754C3E5E401AA13FABA6C43C1A609E770639B3C93566B95F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7AF7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7AF7.tmp
Size 981KB
SHA256 3e4e7142d1926c92fdb7095db0c8afdce1ec562700d5ca1400f6afa4f9b7e1d1
MD5 65b69dec9094c1e86cd029cf780f6c63
SHA1 cf403bbf8f67a524ffd6a7ae50b290f17b682906
SHA512 b6f6c8f667162133d96f8b3e7ea655c072a74788a4f9fbb40c8f6aeb711d4d56ba487d132a5f1ab9df1e5d3f7248397080885cd9c0a0751b11c9db89ecaddb6d
SSDEEP 24576:FXTo85eH3w+/2rsR9DC6LZmym833ofI+Xf5xbPh:FXTo85ULurf2Zmym8SPpP
TLSH
T141250115B9808072D1E629320EF68712097B3EA687E6B8C773C07B153D76DD1A73939E
MD5 SHA1 SHA512 SSDEEP TLSH