5ef5a5cf6b97217a57e7f127fd09fc8d8f2ddf3d1b17a62f07a694d21e8d2fcd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260808-d53rvsswds
SHA256 5ef5a5cf6b97217a57e7f127fd09fc8d8f2ddf3d1b17a62f07a694d21e8d2fcd
MD5 51f30145836bd4b8b79024a6dc471a96
SHA1 29d55484704bc41d297cce3d0f5bc17be6c7ab3f
SHA512 c8e2be10c97ae2e67e8021181ed450628696f712714b0d943988482e9e457ad62aee1e074661cb41b9ec86514ee3a011d55ed25e600e96d293649ce7d4a16ba8
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnFuylb+0FTaq/Fkqu58CXE3dDxciamiHky6Td0c:U6PCrIc9kph5uylb7daqe8wn6vw2p
TLSH
T1FC94E0347681C036E2D306308AEADB66593A7D755726A8C73BD467AE2E703D1E73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4000	AD81.tmp

Executes dropped EXE 1 IoCs

pid	Process
4000	AD81.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD81.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4000	AD81.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 4000	3112	2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Users\Admin\AppData\Local\Temp\AD81.tmp
  "C:\Users\Admin\AppData\Local\Temp\AD81.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe 3084E669B59F07EDB28C2BE26497B9E50B3451E8056BF59E7BF17546C5B67D2D79F94BB22AD3FCA20F4B9C27F643359275AEB6948B9A46E01E46AB8A1539E78E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AD81.tmp

Path C:\Users\Admin\AppData\Local\Temp\AD81.tmp
Size 412KB
SHA256 98452bb6f538e2210f835ded77c9843f3d8b6c1f926c802f3a340de4cade3c82
MD5 5304acdae22134e09311f62e4137aa19
SHA1 4462a90e28c03097aa905d235dd60107ad9f5eb2
SHA512 1621621f876f167c5e2aec37394fafb4be0a0ab2b588fbe4882c4b93db8001eb13442481114225e4284a0b4fe13d09ce212a7b316a1f8499edbe4258e75bcf3d
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnnHLgiztYzjL7S6CBmmcxOqD3Q85xP:U6PCrIc9kph5e4tYaxBkOgA8X
TLSH
T1CA94E0347585C036E1D305349AEADB66293E7E754B62A8C73BD05BAA1E343C1E73834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads