ca9563b121ffee893a31cf867e73526f2a9dda296fa182f153c8e8a2494e0677

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_b99749be4d392e9f9847d45018572e2d_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample261026-ryw8dsfv8l
SHA256 ca9563b121ffee893a31cf867e73526f2a9dda296fa182f153c8e8a2494e0677
MD5 b99749be4d392e9f9847d45018572e2d
SHA1 5ed95fc221681ee7bf00ccaa71fb3a6ca44ca1c9
SHA512 326c497a8b7756700548a29931defa046bb7b51779eab5f91b1ca6891cc79673473d34fc078ae75f4b6e9cf25805b216232563b01548f42717935cd09355a833
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnbsRo1HgIHSZ2NLVF7cJL4up72wacUCP:U6PCrIc9kph5psR8gIHfBtcvl2wJ
TLSH
T1DF94E02435C5C036E2D315354AEADB661A3A7E354B26A8C73BD46BAE2E703C1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1308	9006.tmp

Executes dropped EXE 1 IoCs

pid	Process
1308	9006.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_b99749be4d392e9f9847d45018572e2d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9006.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1308	9006.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1308	4904	2026-10-25_b99749be4d392e9f9847d45018572e2d_elex_mafia_stealc_tofsee.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-10-25_b99749be4d392e9f9847d45018572e2d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_b99749be4d392e9f9847d45018572e2d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\9006.tmp
  "C:\Users\Admin\AppData\Local\Temp\9006.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-25_b99749be4d392e9f9847d45018572e2d_elex_mafia_stealc_tofsee.exe 95C038489FBA36816B57B8037157C8EFD547D7E09CB9FD50ACDB9A13AEAFB21058233EA0C9FECB28DF0D72530F2162FA92DA38CCE7F5ACA8D2BB3FEFCB51347E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9006.tmp

Path C:\Users\Admin\AppData\Local\Temp\9006.tmp
Size 412KB
SHA256 48cfbfc139fd55748c3f69e8fb78e6fa2e2249cac56f3a69325ebd2cdb3287e2
MD5 04aa890c19eb5d6dfe378bfdd5c82082
SHA1 1cc77857afd6e766d39b5670f27049557240d8ea
SHA512 f370359d05a5d7cbdc8037460bf7876d5c5842cc1d82f2bab91148f16ce34813f4ce3ebe93d4cd3aef14e2f56f0571ca672b68841a6e01c469f2fa8ea0792692
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnk45fmzqlcj9OSdgMU0qrGhpK5UX0Wc/MIP:U6PCrIc9kph5S45rlundF0GhpgUkWBQ
TLSH
T17394E0343581C13AE19306348AFACB66193A3E754B22A4D73BD46BAE1E347D1E739347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download