d34da0dab2e3d763e540a25ac5e57a9d12a2ee50e408f50ad418b97b3215e983

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260814-3j2ecacf49
SHA256 d34da0dab2e3d763e540a25ac5e57a9d12a2ee50e408f50ad418b97b3215e983
MD5 7b97e818fc73acd87d96c375cc06607a
SHA1 727d0fca36ae0759c21528a6cdac69d033f8198e
SHA512 e6b5662041a6efb72d13a51f436ff459bbe579eeb126398bb479708919ff5e9214da4617374324100e7583fe94146cc32bef98f60ed2d7247625788d348f1987
SSDEEP 12288:Nb4bZudi79Lea2Is0ZlHdl4aRnglZgX5zzyiA0a:Nb4bcdkLcIrZVduinKZo0
TLSH
T1DEA4F1213182C037E2A702354AE6C7F6657E7DA15F61A8DB3B903B6D5EB02E1DA30317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4252	FCDE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4252	FCDE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FCDE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4252	4236	2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\FCDE.tmp
  "C:\Users\Admin\AppData\Local\Temp\FCDE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe 1C480B4F9018A3C7CA5E7CC81A216E0767E11312E3157382CBF320526EFD78C1224C388FAF4C41578346A4A763F4A6816B359A536974C88F6AB274744F12EF2B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FCDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\FCDE.tmp
Size 473KB
SHA256 e5ae8455d5370839b6edaf26605ae99502d32c59e9bc686625d69ed67493994a
MD5 be0d345e56e780f33818b16c3267e94c
SHA1 5790cbb4e2f7f1d46b3c96aef415b0ab1176d086
SHA512 7b243fad15eb7b3e1f712679dbab696781db6d08e0c20a4fd940136fad827605447fd95ec3e666bc20f05404f74b04d044e19276dd90377826bac0dbcc20c2d4
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSt82P3OJAmQas19dp6x+2GduziVi+5uH8SA0a:Nb4bZudi79LQkEaa91uiROA0a
TLSH
T167A4E0243182C037E26716350AE6C7B5653A7DA19F7194C73BD03BAE6EB02E2DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download