37831dc092d738573c7d589712d75fc39af5d4e708b0d7c89ce9a74bf7130906

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5f7b22df9d04eb55dc3f5d7df9b6f457_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260810-vybs8syycs
SHA256 37831dc092d738573c7d589712d75fc39af5d4e708b0d7c89ce9a74bf7130906
MD5 5f7b22df9d04eb55dc3f5d7df9b6f457
SHA1 3e5633241b250e18a82cff2515c84ae3fa6b02ad
SHA512 e5fd573530208df217777b3dadaca3e2dc21a0601d56cd90c3bbca6bb9b94a9b49c38f387e56fddc5fbc1b0de56febf0035423507c41dd87550d8bd8d437c6ab
SSDEEP 12288:Nb4bZudi79LdWBRdn/okY0+hWtcGFrdQAaA0a:Nb4bcdkLwnz+hWtcGFCO
TLSH
T185A4E0243592C037E29712350AE2CBB5653E7DA18F2168CB3BD4776D6EB42E1E638347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1928	EB55.tmp

Executes dropped EXE 1 IoCs

pid	Process
1928	EB55.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5f7b22df9d04eb55dc3f5d7df9b6f457_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EB55.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1928	4720	2026-08-10_5f7b22df9d04eb55dc3f5d7df9b6f457_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5f7b22df9d04eb55dc3f5d7df9b6f457_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5f7b22df9d04eb55dc3f5d7df9b6f457_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\EB55.tmp
  "C:\Users\Admin\AppData\Local\Temp\EB55.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-10_5f7b22df9d04eb55dc3f5d7df9b6f457_elex_mafia_stealc_tofsee.exe B84046DCCEEAF1E62A5BEF0DBB92CC077A4428336AAD426963CC3AECBAC839FCA93A958D410384C61C9DD84F84488D32075B1E073C403248F49FB6F77ABFFB68
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EB55.tmp

Path C:\Users\Admin\AppData\Local\Temp\EB55.tmp
Size 473KB
SHA256 4efbba2b7abc30ca63eac7eb58b09ca4ba8c7d58e36c5e141407b0f82a178082
MD5 0e39520030ac0bb560130cb148cad761
SHA1 f8c91883b731138f9ceb80ec43b2c08ce1892bbb
SHA512 c40b5580f374544f98f578580612621c1133688be4a88ad5ac30e29e2fe8869075733f3aa42d443ae88413af051c471b295966a927173bfaeacae4384f359dd4
SSDEEP 12288:Nb4bZudi79Lsi+pJR37cPXanMCDRFxRLZ1QwUA0a:Nb4bcdkLsiwPoXafDRFxlTzf
TLSH
T1ADA4E0243682C033E26701394AE6D7B5A63E7DA14F6568D73BD43B6D6EB02D2DA30307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download