194347539dcbaa6af67e1cf7482d17c280578fb3eaeaf353753e7e2cf01ce495

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample261024-dnlr1sft9s
SHA256 194347539dcbaa6af67e1cf7482d17c280578fb3eaeaf353753e7e2cf01ce495
MD5 9c64f393d41306f9d87394e23acb2eaf
SHA1 97d7022f784be9dcccd9ff705b9f5900b5199aa7
SHA512 291dc968c7977940bd413e4bbd4b1d58cbbae538096a419cbfa3e29ad819034781e3f33a862c83c10ada46b4f27ecbcb4ee426210dcff16de58e7e4530da8496
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZne8KuKVvq+HxRH67yge9PEcxatCMzcfCP:U6PCrIc9kph5UDFVvby7yVP0CMgfa
TLSH
T13694E0243586C036E19315318EEADB66293A7E754B7264D77BD42B6E2E703C1EB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4632	9778.tmp

Executes dropped EXE 1 IoCs

pid	Process
4632	9778.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9778.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4632	9778.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4632	4736	2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\9778.tmp
  "C:\Users\Admin\AppData\Local\Temp\9778.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe 56E19BA5EF337FCE7539780A6948D15BF52A582D8BC32DBDF44609A2D80A72C53DACC0FBE5DB08336AF39468DDDCBD2EECD10206B6923F3CEF64F510A82D328A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9778.tmp

Path C:\Users\Admin\AppData\Local\Temp\9778.tmp
Size 412KB
SHA256 f2ac7d17452314e16e30574cc10735e124897a07a6c96dc6e6683b61c0ed4c30
MD5 7d69e6e4cab78158944db80cdb90ab3c
SHA1 a3f29b9cff253c1ee6e40c786c94abf026215d40
SHA512 aceb107ac15f4f7afdc608739e2ab61c2205c3ced42b0ab6837832613c9006991d0af59da13062da9403f98858c3c6277a76030029b7f0ee3a024913eeaba0be
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnL9uYbpeHu0qxRXgDA3PXsUYpmh3mVCP:U6PCrIc9kph5zD0qxy8fXsuFmVa
TLSH
T12C94E0307181C036E29316318AEADB66293E3E755B2268C77BD42BAD6E713C1E734357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download