86eaabbab76ff273a436b68654a5fc2d6674e95cb5b5eca2deff0aef84674291

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260817-ptqhya1wat
SHA256 86eaabbab76ff273a436b68654a5fc2d6674e95cb5b5eca2deff0aef84674291
MD5 c81b44f96a514328cc602097a996ace9
SHA1 eb37770c58f6631c1aa041e649ae3a96ae8dcc58
SHA512 b633bafbfb5626e249c2f3f4d8608c1108abbf1dd4c5b582e3f9133170d7fbc64d5af8c03d1e85f861005d213f35d5c3f85610267295c58799fb791de46b59f9
SSDEEP 12288:Z594+AcL4tBekiuKzErJSFQUV2WSR5lO8AcXwl/eLmLjLBqrl:BL4tBekiuVr087AJe8jq
TLSH
T1AD94E0353586C033E16715354BF6C76A597A7AB60B22A8CB7BC00B7E6EA06E1C735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3864	7D59.tmp

Executes dropped EXE 1 IoCs

pid	Process
3864	7D59.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D59.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 3864	1228	2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\7D59.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D59.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe BBE3598AE87731BBBF49D48512549C515CBB9F139DA43E1BCCA0A3E1D8F700B597C881ED1686A747EA2A16B4684F4A5BE28DAAB617FE89C00D12C31D99A4E842
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D59.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D59.tmp
Size 428KB
SHA256 739d7a0c1ca61e7dfcebe0a4fb9378ac96975673ff5c5f812f79d3efdbd96fb0
MD5 18787aeba9228f73c7d9955b8eb93113
SHA1 a060ba9d315fa6c63979e2dc8e65b6c7b7078c5c
SHA512 5673fff63cbb9a7a96ee63cae2a291ab97d6aecff3747053d1a0bf2d8e908c0bf02e8eb1e140a09abded37d3800c8dcdf592775936254c14b6601cf3721c00af
SSDEEP 12288:Z594+AcL4tBekiuKzErQtIts6oe8TjM+O9mzHQl:BL4tBekiuVrxts6CjM+OUk
TLSH
T19494E1313682C033E26716348BE5DB66567E35A60B26A8CB7FC01B7D2E657D1DA3034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download