24b8d1cdf0448c5dcdff62f13c8d2525d34a4e3ed5c68edc33c9b450995d52ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260814-2383vstdka
SHA256 24b8d1cdf0448c5dcdff62f13c8d2525d34a4e3ed5c68edc33c9b450995d52ec
MD5 bad17f3aed2c33c03f78fcbbd02f67ea
SHA1 b6feec8427aebaee17a44a49def05155e6d7c146
SHA512 fb61f2062d061b16c5451ed3f19beff4f6023a63191db6763368222de0c9e59a5ca9e9ae97eecdd7241ad36e265e9043b0dd8a7b3b6dd1f343c7108ad3bd3529
SSDEEP 12288:fd4x+ePixnXQjaVLLSSvKSjOjOxY8McwP:fd4x+ePixAj4uSSSjw+DMc
TLSH
T1A494E0203586C03BE1A716348BF5CBA9593A7DB44B32A4C777C42BAE5E642D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4908	EAE8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4908	EAE8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EAE8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4908	2252	2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\EAE8.tmp
  "C:\Users\Admin\AppData\Local\Temp\EAE8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe 3A75C0BE322FF8E6A7117171010B0816FA2EC2D60326E754E6AB3B1BFB8F768E23718F500E47F48A4F5F760265D304E88B28EBBADEF0D9858B9B1006E95D2B1E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EAE8.tmp

Path C:\Users\Admin\AppData\Local\Temp\EAE8.tmp
Size 435KB
SHA256 50337f4d859336c7ea74e1b0ea21cb10c864a0679b76161d68538dc23557cc7f
MD5 dce713b4d4e6ea63d77801a7d8af78e5
SHA1 e6ac970aa6e5df9bf04923d52d91345d4e55df07
SHA512 0566ca85aea67826c22efb9fa90ced10c0a1bbc1a901cc19de32aaa26ad97abcdd569394238dcc6f6914359f6558fefcb40a9aa093d37dd423d79bf26269d50d
SSDEEP 12288:fd4x+ePixnXQjkZBZI0aoE1vGhAblI4WIH0jIwP:fd4x+ePixAjkZBqTo4GhAblI4Wqp
TLSH
T17394E0253186C037E2A711344BE5CBA968797CB00736A4C73BD42BAA6F746D2DB3531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download