717d05f9a3828d64d961ba3a5da9800747ba941672fb8cc870d9d499f288f1a4

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample261030-wasmhszzcx
SHA256 717d05f9a3828d64d961ba3a5da9800747ba941672fb8cc870d9d499f288f1a4
MD5 c3265cdb5407d8a9aed95475c8953ca0
SHA1 3e0a8424bf4824769a2170d46257533e99a58667
SHA512 c9cdb07e1dba88bf2886e9107c651b20720aed8e19e5d31c0a70ef1301cf2afca40b4d28d337085afe57ed2ae5fe7b664bcc2628b010da29747751065b7ea83a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn57TeVZmvAMwRmu7lY1Cswnp/K3yUZr2sCsiP:U6PCrIc9kph5CVZmkJLswAIW6
TLSH
T1E094DF203681C077E2A315319AE6DB622A3E7E355B21A4C77BC467AE6E707C1E735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4640	483F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4640	483F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4640	483F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 4640	732	2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\483F.tmp
  "C:\Users\Admin\AppData\Local\Temp\483F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe 91797DCD777EAEC9BE4E337AC854B1C3CF136CC83FB9CE570C658CBC3767CC79591097457148E8E4D200B4724244604D625BC9DC2724CBFB8DF0A0E59343D1DF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

483F.tmp

Path C:\Users\Admin\AppData\Local\Temp\483F.tmp
Size 412KB
SHA256 47077a7e36d7a50415f0177c25ab94c56e405fad7c6397ffb610240293fc234f
MD5 b49c9eae257ed61f2087f3fa2fcc2bf9
SHA1 4caf291214480c870fe3cfecc5c0da16dc6126c1
SHA512 1abffdb0120177e4b4ad236db53240d7bbd78ca0b94e57cb49aa00fecf45e544704b5a0ed17c1a03ddef9e10cb6890df4fed153ea214a2771fbcac36d627c22b
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZndd7CSWszFVbgvz+QIlL2VooNIShNP:U6PCrIc9kph57VbIzWZeF
TLSH
T1DF94E0243581C036E2D316348AEADBA6193A7D754B22A8D77BD45B6E2F703D1DB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download