cb39fbeb6d4590f11a3c60fd1d7c8ff0fd1aa2644d9be2a49f4a3e8de84550a6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260817-vwtahaep4y
SHA256 cb39fbeb6d4590f11a3c60fd1d7c8ff0fd1aa2644d9be2a49f4a3e8de84550a6
MD5 feec83b80269d32a2eb2aca04425407b
SHA1 2ac09ae8d4ebfdd115c410c95d4b13fee41ccb8f
SHA512 22f7b633cd7466eda216e098930bf463902a61f2958bce79a809e31f71ac4fa97cc1a1cb7e499df76f806083e1ef05c2d38cda68b548f79858842902329f72c5
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHSz/2/IbnDSsZYPU2PnS6u6Z:Zm48gODxbzonDoP5DJZ
TLSH
T19E84CF347281C037E19601314BFAEB611A3A3DB64B6468C77BA47A6D9FB13D1B63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1216	48DB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1216	48DB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48DB.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1216	48DB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1216	964	2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\48DB.tmp
  "C:\Users\Admin\AppData\Local\Temp\48DB.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe 119561A2E2D4CDFC03AF1125290D468C4E2851B5741DE9ECC1C771760BEF11C9C0004C1C4AED85C80D5F58F6D37554A9AA21E68AE56C7D610F195A5FE9F7BD0C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

48DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\48DB.tmp
Size 384KB
SHA256 000a46d55c991987046b11194ce79bfc92fff041170dddb03913cbacfbf9e8e4
MD5 e743caf22ae4533778e77f518584b3ef
SHA1 0b86223efbe50a81d8b113c4e1fb08431c71d734
SHA512 96a0fb132ce80477c9f383dfd08c9f456f62d6e1f4468c29e5638aeffb72cad4ac9b3683cda92f9054e1142d05657080cb389b40eb54d6edebe152d83ea3ac0b
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHnVOqxRWSUSNzCtS9cQIEDttcekyDg2JZ:Zm48gODxbz5sqqS7NzCtuIEDY/+jJZ
TLSH
T10584D0347681C033D19605314AF6E7626A3A3D728B6568DB3BE47BAD9F703D1A63430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads