9c56f40e65aa6390570ea9593c429523cedf092b46531402e22eab499b0c5701

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample261102-brw12set2z
SHA256 9c56f40e65aa6390570ea9593c429523cedf092b46531402e22eab499b0c5701
MD5 fedcda4d8af7851f1f0f6001a65e239b
SHA1 b4f970d454e3a09ae9617aa7cb477d8f9fc1b46a
SHA512 9d2ec8cf63fd1d16f1e7d58bdd718388aa8e6d582a974bf6705fbcae95e1b18e151a9b4ab0b820936e070ca1a80dd46552674523895bfdab3108b1a2f4ee782d
SSDEEP 12288:bO4rfItL8HAK8rd2xA086lCMF5dl7st8U75UO:bO4rQtGAK8WA0VlHTdl7tUVUO
TLSH
T1EAA4F129B2818133E29303715FE6DB96A63E3571172AE4C33BD4426D2F616E1D37638B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2624	CCF0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2624	CCF0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCF0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2624	4092	2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\CCF0.tmp
  "C:\Users\Admin\AppData\Local\Temp\CCF0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe 4F2434A1DD17001F2EFABF52AD5ED9EC177295F0AFFD214395BCD12DA204F49BCF5E0147231110B777717525035DAC37B90A230B0719F735779B282F4C1E39FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CCF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\CCF0.tmp
Size 479KB
SHA256 1e66c02537144ba0534118e2ce24a90fb9a143bb97580ce5257142567ab48389
MD5 2875681ffd258bac8b35e2f82b625264
SHA1 067efa4cf9b42cbf288e5af93c35c6aeb74d8830
SHA512 b36564af4edbc4c37f6786f86bcc09e9386d9383208f4ecd2de43f0b6d80df662ef7f9a43662120426b5b3574dce60332938f89ed63139447157b83a636b71f0
SSDEEP 12288:bO4rfItL8HA7mUhv4JtbDbBT8/mbA376D+mnUGjU75UO:bO4rQtGAiUhve/bBIO839kUVUO
TLSH
T132A4F136B3818133D29302711BE697AABA3E35B04766A4C77B94027D1F617E1D37A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download