fdaac786b376e57c93a655e2a0891700df52d0e02e621fc57c8d714bc9bcbf82

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_18fd043d056b4db7c99422b09002356f_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260825-wr9mcsac85
SHA256 fdaac786b376e57c93a655e2a0891700df52d0e02e621fc57c8d714bc9bcbf82
MD5 18fd043d056b4db7c99422b09002356f
SHA1 4b6382f500470caa93d8102fdd358008ea2de4ed
SHA512 ccfff61dd3f8fe444b5082b2ecdb50dd331e4d6906a71674d08acdf86f44373d764a9f7a8f63b66f6287d5248c26c90d185980f7c1e479c64ec47091c8342330
SSDEEP 12288:Nb4bZudi79LFvvhfgic8CVQCTBBRuU2A:Nb4bcdkLthZcRBnx
TLSH
T140A4E1203581C037D2A305344BFADB76A97A3AA15B6268C73BD45B7E6FB42D1E234317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3752	A60F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3752	A60F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_18fd043d056b4db7c99422b09002356f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A60F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3752	1700	2026-08-24_18fd043d056b4db7c99422b09002356f_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-24_18fd043d056b4db7c99422b09002356f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_18fd043d056b4db7c99422b09002356f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\A60F.tmp
  "C:\Users\Admin\AppData\Local\Temp\A60F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-24_18fd043d056b4db7c99422b09002356f_elex_mafia_stealc_tofsee.exe E2E3AF91265A2B23A001F5AC0E6A797CAABFA499DC9AD087A35140AE77E1721AAE09B3B679177B9A26FB9D8090613D7A571B3E49DB200B9A484C6319117C993A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A60F.tmp

Path C:\Users\Admin\AppData\Local\Temp\A60F.tmp
Size 444KB
SHA256 5592fa24c84bb7b5e625a630e1b915b6613ae24096f57969f8834320d12e3e1c
MD5 9ba3a3d1542b076d8e78796eb12b5484
SHA1 6370b9777f7f5a2a97f618f10f72fb406dc5c728
SHA512 f9dfdbe425609009bbe35b2f70a5e88e623634aee78e390a70e1350d1a3024583bfefad4079c6b1a615575ff7ff4c7914be9c6d1b1ce96608f4ced59613f917e
SSDEEP 12288:Nb4bZudi79LX/tIH3VUQ7VgCCYgdid7rA:Nb4bcdkLX1IH3VUQ7aCmO
TLSH
T1C2A4F0243581C037E19305344FF6DB65697E79B14B22A8C73BD05BAE2EB02E2E63535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download