e0bf3d53a904ecbe7c45b0d95c3f3eeae763272c029df41d059f48664be2b678

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260910-p5fg4stene
SHA256 e0bf3d53a904ecbe7c45b0d95c3f3eeae763272c029df41d059f48664be2b678
MD5 9da0877e85c4a0e14954fb4c21cc53ce
SHA1 793db2fab9ff7077ac26e68fac70b46e10bdeb28
SHA512 89a3214dec844473eda89f824b25bf8e8bf0bd38ac9283443108d5cbafd1eba37ac550537d92585daa8548743d77572de91663474e165a675379f056925e68d7
SSDEEP 12288:Z594+AcL4tBekiuKzErlioTiAu9oU9gPcQp54arl:BL4tBekiuVrcoTLYoOg0cxr
TLSH
T1CD94F0263582C037E16721384FF0C7665A7E79B24B26A4C73BD41B6E6F682E1D63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1456	4FC1.tmp

Executes dropped EXE 1 IoCs

pid	Process
1456	4FC1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FC1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1456	4428	2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\4FC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FC1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe 8580F13CD7DE2D2D42B516D6CE9A3192CBEF9ED6E8077E1428D44B6001CE1334DC108BD57F4077EC22FF44B775ED50412EFD1BBEC36CFE78662CF1BA1CFB68E7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4FC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FC1.tmp
Size 428KB
SHA256 0d2347f76ab8a2d429b0f6c51b12b02d0b2b969e2297f9f69530466f951c06e0
MD5 8421d3a2807b11bc629a96dfaecbf1ac
SHA1 7f53be62e4bff53037483697699ef77c3a62297e
SHA512 91016a996063659cd364e8d3f85bbb9b6375cbbff276e873bf9f6c9d298bb82bfbb79914d103a0dcf79c6023ea48fb62d0377232d38a1be764b1ecbb15159206
SSDEEP 12288:Z594+AcL4tBekiuKzEr2dwQ4TuGKCdPLL8l:BL4tBekiuVrcfmuGKEPU
TLSH
T10B94F0313586C033E29706344FF1CB6656BE75B55B22A8CB7BD40B696FA06D2EA34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download