eca2ad3e54803eca3cdc435d196e36bed5aa21883888f40f8485bcefdab75c9b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260819-e6jaaayvbt
SHA256 eca2ad3e54803eca3cdc435d196e36bed5aa21883888f40f8485bcefdab75c9b
MD5 bc456041feaabfc0186054f0fd980997
SHA1 f1bcd746afb63582f033d8cab4483e305a5b3437
SHA512 078cf89670039f853778fd71d3149bee48e822ea795e862ac838b11b0d154400339209191fb2cd93dc0098612c5df5c38d0f6fe6659dae1aa753241aff69d113
SSDEEP 12288:Nb4bZudi79LejDnzssxfhHy26GrVZN28TdgyohA0a:Nb4bcdkLej7gEZHy21928Jgyoo
TLSH
T1CAA4DF253581C037E29B06384AA5D7B5663E7DA15F3168C73BD07B6E2EB02E1EA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1132	31E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
1132	31E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31E8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1132	556	2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\31E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\31E8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe BFEDDF55838577A016F4B12283198E53A78597574A7ED77D9C2CE12AB9578E9349657ED1F82FB82E87A0264B8F5A648A06F3D651EE52B5EEDC84C679AE7AE55B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\31E8.tmp
Size 473KB
SHA256 b6c5658b021d22ba1d8968c0bbcadfcc7c447b918f5b1db8983cc6a13b52b92f
MD5 b4feeb60e5b56a3b95ccea7479be2a79
SHA1 c9922d681a7ab795f3a6755618dec67d01104443
SHA512 ce4a01b079d75803ac72efc58040f6d4f406cc9aaffedcbe055b972b0aa9aba21e5ef39c2526f99874a1aedc0e73d5ef60d355c0e1b62a28898581950c150ce6
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStyuPyfAYSh4RQ2BemG2u5BGk2Hx1KDkDSA0a:Nb4bZudi79L5uPLYg422UmHW1236A0a
TLSH
T1CFA4E1247582C037E29702340AEACBB5663A7CA19F3664C73BD47BAD6DB12E1D630357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download