97429dfd87853709fbc1944e04bdb74e7bc2733d6bc2c1fe2a4c91f181f73e04

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ef39ddc105e7f977d245172841834a9d_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260802-jl3kmseq8v
SHA256 97429dfd87853709fbc1944e04bdb74e7bc2733d6bc2c1fe2a4c91f181f73e04
MD5 ef39ddc105e7f977d245172841834a9d
SHA1 3c5604252f1f43f7f8997c6075aa399a8ec4acf7
SHA512 3eb5f4574fa8696cb7fb9cb9cbf8eb0457a9543b3011f0ca11bf38a5c3a7de34af40482ec1b1397319f935763e68a2383248697af6f4fd2dd8d46ce37c21da3e
SSDEEP 12288:Nb4bZudi79LjUnaQiY11URTOkz68Ad/A0a:Nb4bcdkLjUnaQz1UR6ke82q
TLSH
T19DA4E0203182C037E29716384AE5D7B6663A7DA25F2164CB3BD4377E2EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4580	2A66.tmp

Executes dropped EXE 1 IoCs

pid	Process
4580	2A66.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ef39ddc105e7f977d245172841834a9d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A66.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4580	4728	2026-08-02_ef39ddc105e7f977d245172841834a9d_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ef39ddc105e7f977d245172841834a9d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ef39ddc105e7f977d245172841834a9d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\2A66.tmp
  "C:\Users\Admin\AppData\Local\Temp\2A66.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_ef39ddc105e7f977d245172841834a9d_elex_mafia_stealc_tofsee.exe 2C358E021B2DBB4CD745808A5BC7622F5B0AA24DC8A6F6648F4E17BA6BBD21F2DCDC25AD4D67CEE128E3EF301277DFDF16C2172BC6F56B5DB2CDF6B31DC5B104
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2A66.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A66.tmp
Size 473KB
SHA256 9dc6612239a968d5af537c8f9663463ef3efc729e903249b64b4d9d1668a39c6
MD5 bbf3a078e536f4c870ba9420b5b65926
SHA1 f101260bd176bb12ccfcc22a5d9a8c649e5de38d
SHA512 d17b7495ed8e709e30d94743b6ff4e14d07bf7e24f5a5e3630ea92a0b0f9ba18e5f249571ee97aad2567fb449205ad40509aef28c1dd469ed9599b83a63dc5c1
SSDEEP 12288:Nb4bZudi79L4sfHzMpU7Fvxd/SmBiHYnA0a:Nb4bcdkL3XJvbFYYy
TLSH
T182A4E0243181C037E1A705350AE6CBB6663E7DA25F6168CB3BD037AD6EB02E1DA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download