19fc591df597d4120dce7846ba7eb859089cc5ecd6e363c38f2aaff99d268613

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_9130731fbc58092595892ef84a7ca089_elex_mafia.exe
Size 446KB
Sample260416-jdpc2sdv9t
SHA256 19fc591df597d4120dce7846ba7eb859089cc5ecd6e363c38f2aaff99d268613
MD5 9130731fbc58092595892ef84a7ca089
SHA1 c5ed47f835af20ca6f4559a08c22ca0b90f48cb3
SHA512 72d1dafbb22a4bcdbb98fb45ce18b13c0ca7d63bd5c2e6da7dbd377a61e3031927e718e90a064e7d2ec0bcb85b02e0aed00f88aa0b5b98c25a6cf62582415983
SSDEEP 6144:6H4ozQAja2HQT2g9c4MIw0JhZe+HnprzZV+Kpxv+RP9A0DVZNbiWQpuKVP:+6PC74MIw0JhZNvMKp+9DVZFiSK9
TLSH
T18FA4D0147581C13AE1D608315A29DB67193E3F758722A8D73BDC2BAA6E753C1EB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4712	3F94.tmp

Executes dropped EXE 1 IoCs

pid	Process
4712	3F94.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_9130731fbc58092595892ef84a7ca089_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F94.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4712	3F94.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 4712	1064	2026-04-16_9130731fbc58092595892ef84a7ca089_elex_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-16_9130731fbc58092595892ef84a7ca089_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_9130731fbc58092595892ef84a7ca089_elex_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\3F94.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F94.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-16_9130731fbc58092595892ef84a7ca089_elex_mafia.exe 36BBD42B0E4742031D091DFBD341DE6B38F5A1DCCF1297A62C23036CA7A9F23094E1C29EC3BFEE517160027A1B489D8588F936B49F7AC563C918ADC383F59D10
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3F94.tmp

Path C:\Users\Admin\AppData\Local\Temp\3F94.tmp
Size 446KB
SHA256 4c0440d2d0e2b74931f917974bd3509a0f0c876a96cc7f3e0e7cf1573b000695
MD5 4aab7fc72f4bf3b28f9b72c1e9ae8149
SHA1 9a32906ab34007ebacaae4e93e385aa82ea02c73
SHA512 bba18f94cecf326e0b768d441b824694f6c1e94f66c9dc2f75046611afc79dff6e229acbbe7def6e536e44808fdc47d6d1640c6721402b9b53bfa73711c4a69a
SSDEEP 12288:+6PC74MIw0JhZnm1FvaDBTPu6X5zXnUekj:+6A4MuhZEaDRPHX5zX
TLSH
T1F6A4DF207185C03AE5D205318A25DB67497E3F758766A8D73BDC2BAA2E713C1EB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads