bf57c2b9e7e070497658d7d845da7b0f16725fe6a1f3315bf56d1a4b462efbf0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260825-dxy4pswerc
SHA256 bf57c2b9e7e070497658d7d845da7b0f16725fe6a1f3315bf56d1a4b462efbf0
MD5 b5404d807762e93a9214dbc465782f01
SHA1 6364b878172657ce6b59c8a82df0352912ed77ba
SHA512 68627f49141eae543eabeba6e9ee8735e83c7228e7d9407f008bf0b8a9172c6cda345be2eef21ba144d06a69a71651313ac6b348d52f8389b752ab2d69427c17
SSDEEP 12288:gZLolhNVyEd5eG2TpkUkFvoxxkm9NP93qH:gZqhOESZpwFvoTBD
TLSH
T15D94CF24B2C1C032D19300354BB6DB76193A7DB15B6168CBB7D83A3E1EB53D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4412	8306.tmp

Executes dropped EXE 1 IoCs

pid	Process
4412	8306.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8306.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4412	8306.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4412	3384	2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\8306.tmp
  "C:\Users\Admin\AppData\Local\Temp\8306.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe F756ECD89EABA79974E39A90872D5EDBD847495A1830B53AAC78F1E62CD99690371614B2D1EE315107243C0D348FE12F228ED5A4183C50DE3A2A7F996533EB8D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8306.tmp

Path C:\Users\Admin\AppData\Local\Temp\8306.tmp
Size 411KB
SHA256 d8f4adad39cbfb3996ed7048b8d924cae2d817615b08d42be5fd27aeb5e8fce0
MD5 7fb06aed7074efcb2af0181f5754d455
SHA1 e7cd3a4b2271a1bd9d41b76c07ad9f36edc9e683
SHA512 b3c6294cb23ccb7c89bba267736c911cafe2060cb34e1b023d31bbdacde7e74ba87d859308ee71716344944e6480079a4ece85181047bd1dbf996f64b0ba347d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFkPCNR3n0eykwVW4YuOmjOS3oAKfHeh27l/xdforP:gZLolhNVyEwfwkPEoLfe+lZPqH
TLSH
T1BA94DF25B281C036D19301314BF6DB76153A7DB24B6268CBB3D83B6D1EB43D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads