3e64ac6ba0e805aa9fc1d1223e13366776396c6804efcdf0715afa23389938b7

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260731-hynftaef44
SHA256 3e64ac6ba0e805aa9fc1d1223e13366776396c6804efcdf0715afa23389938b7
MD5 a5e99442f2ea9b41cfef0e88bd2b5c01
SHA1 133e5cc646f9271e365ea6e492f1f43a951b0480
SHA512 0c059ebae271f970e2e50927ed3723599d405e24daa9aa0772d3bf6ff2c3fd405b07487aec3855d413bb3a855ef128af623fbae3eca346c46ffb23f57755940e
SSDEEP 12288:fd4x+ePixnXQj6ygRN9apts1VqvbyzDVNY1uwP:fd4x+ePixAj6ygROptfyoE
TLSH
T1D594E0313686C036E1E305348AE1DB66697A7DA05736A8C73BD43BAA6F702C1D73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1736	5407.tmp

Executes dropped EXE 1 IoCs

pid	Process
1736	5407.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5407.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1736	1700	2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\5407.tmp
  "C:\Users\Admin\AppData\Local\Temp\5407.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe 7D233822A9EE301480E307BF0365BF82CD9F3F41C0EF7DADF26252E16C2AA84E53B42712369C93F08DD267D9DA2DE567FEACEC207E2286FB1C096C994971B4CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5407.tmp

Path C:\Users\Admin\AppData\Local\Temp\5407.tmp
Size 435KB
SHA256 2e9aa4ea39dfd19cc0890066c50e233f59c3d8eef80aaf201e54998839d93804
MD5 d332b08797feb1028015d29e503ecb5a
SHA1 0e228a3c3102c5f3a2153ab789e14226ace17d92
SHA512 9ccf16c69b98a93368b8218cac6201d99fe907d9a999b3b1f1d3127cbcd813e5383438f92d090888f5d72dd341245a5ada973c005f0d409d539ca0b7081f8837
SSDEEP 12288:fd4x+ePixnXQj+tErmOVXprg1lPmMzwP:fd4x+ePixAj+tYV+t
TLSH
T18394E0213186C03BE1A305354BF1C7AA597A7D711B36A4C73BD42BAA5E752C2DB3034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download