08a3d17eeaa9793d69da2e20f3f09d98c2a4d639eb97d46cf4a95303c7560405

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260809-x2t54athnc
SHA256 08a3d17eeaa9793d69da2e20f3f09d98c2a4d639eb97d46cf4a95303c7560405
MD5 f7e6410924f702f3747e65d53bd4d7db
SHA1 09a3bb3e4ea825591573cc867f1fdf865aaf3695
SHA512 0baed9961360ef760819b72ade1780103fa3c79f90a7720e1285e2a55d20a0d8ed7f1af763466d55ae829bdb6d8ee62d191db8bf3132c610db36cad9f06e63f7
SSDEEP 12288:bO4rfItL8HA/UDLDK+yQBsY0vQtOf8fnvJVIRc75UO:bO4rQtGA/UD/2nItO0fvTKcVUO
TLSH
T14FA4F1267A80C133E29302755FE6C7AA673E39710766A4C73B94027D2F616E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4316	5BE6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4316	5BE6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BE6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4316	2416	2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\5BE6.tmp
  "C:\Users\Admin\AppData\Local\Temp\5BE6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe 715E15140C92D2BD0600E65E2EC44FD933B7C3A0A4B48515A2C57D545AC5767405BF9C74C6D994A7B02B7CC84535A099BB07C9926414074E309CEBCA00EF794A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5BE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\5BE6.tmp
Size 479KB
SHA256 a32fe6c6f398f5bbfc8d9e1ea344efc6b5310d8f4c043db01457714558e663c7
MD5 601eba32225cd84adb6076addca03a92
SHA1 483f8286ad5f23cc1e4e91a9ec45914e91d49edf
SHA512 033e9cb87e565c64bdfe6d9706bc35f3bd5a1a0c84425cdcaf5fb957725d5fdc91d6f503e8bb51b7690abdeeb294d057e1d105ca6ca7e0d02477f170021ee8bb
SSDEEP 12288:bO4rfItL8HA3vQIYbNUx7ZpSJCI0LHrxF75UO:bO4rQtGA3vtYeZpSL0LLPVUO
TLSH
T11EA4F12A7681C133E2E302711BE6DB99A63E75711326A4C77BD4067C2F616E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download