22a8a500c03b1798e49e161a40425bfc9f1141f540cb0fa39f9aa3c9f66aaae8

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample261102-sxrf7axt2m
SHA256 22a8a500c03b1798e49e161a40425bfc9f1141f540cb0fa39f9aa3c9f66aaae8
MD5 8ab4f288f82d8cec8c9c557c8f0b0e7c
SHA1 ac6a411f348f9d938f79f82071cb03a31caca3db
SHA512 d24d656d03f568cb1b01fe757f2d8aaf0ab0fe12f6aee43adea1efe693ad5c37c69437e4993b1840de3a5a8d1b9bd4000282cb01286ca2b46b389584c6c58626
SSDEEP 12288:Nb4bZudi79LG6er+47zwIEH20lKEaVaA0a:Nb4bcdkLG6eF7W9lhaVx
TLSH
T13AA4E0203582C037E29706344AE5D7B9667E7DA05F7164CB3B903BAE6EB06E1E634317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4780	D685.tmp

Executes dropped EXE 1 IoCs

pid	Process
4780	D685.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D685.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4780	4388	2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\D685.tmp
  "C:\Users\Admin\AppData\Local\Temp\D685.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe C3E99A8E5E4134B7839A9B4DBFC4E52474EC0752C302F60BB92FDAC01B96E4DFFE120F2711C8D2A7AD42821B12EA9777B502F812B835E0D670327B85BA19193E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D685.tmp

Path C:\Users\Admin\AppData\Local\Temp\D685.tmp
Size 473KB
SHA256 8e19d73e30457c351b45fc0df273e748f0fc8d1ef285dc6c21a15205339e657b
MD5 8bb5e36e2a7479206c1281dac655897b
SHA1 db42e47e705300a05b1f579d13880752a285ec88
SHA512 95bd92827e107183c368f3c4243d22944a701dc2b59dfed87d2bf9c249502b8f2d8ac29f8cb5f3bf4c3184062309b866014e7ae13d8ed0a2572d82390ff2fd58
SSDEEP 12288:Nb4bZudi79LOB0wdadqpQE1x56L9y8JtA0a:Nb4bcdkL0yqmG56pBJ8
TLSH
T160A4E0243182C037E26716354BAAC7B5553A7CA14F2168C73BD43BAD6EB03E1EA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download