Analysis
- max time kernel
149s - max time network
120s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 12:18
General
- Target 2026-04-16_8463a7711fe5165cc44bb36eb7e97448_elex_mafia.exe
- Size 876KB
- Sample260416-pgssjaew5p
- SHA256 d2001d5983a1a3060ffb7dd1c4fb5f9c07c16475f02beecf35ab1687ee31ac1c
Malware Config
Signatures
- Executes dropped EXE 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_8463a7711fe5165cc44bb36eb7e97448_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_8463a7711fe5165cc44bb36eb7e97448_elex_mafia.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
StructuredQuerySchema.bin
msiexec.exe
memory/612-60-0x0000014A01130000-0x0000014A01196000-memory.dmp
memory/612-58-0x0000014A00ED0000-0x0000014A01059000-memory.dmp
memory/612-59-0x0000014A01130000-0x0000014A01196000-memory.dmp
memory/848-147-0x000002641F250000-0x000002641F2B6000-memory.dmp
memory/848-206-0x00007FF613E90000-0x00007FF614153000-memory.dmp
memory/848-146-0x000002641F250000-0x000002641F2B6000-memory.dmp
memory/848-145-0x00007FF613E90000-0x00007FF614153000-memory.dmp
memory/1300-226-0x00007FF71B730000-0x00007FF71B9ED000-memory.dmp
memory/1300-185-0x00007FF71B730000-0x00007FF71B9ED000-memory.dmp
memory/1376-139-0x00000240649E0000-0x0000024064A46000-memory.dmp
memory/1376-138-0x00000240649E0000-0x0000024064A46000-memory.dmp
memory/1376-137-0x00007FF6D4920000-0x00007FF6D49D0000-memory.dmp
memory/1376-195-0x00007FF6D4920000-0x00007FF6D49D0000-memory.dmp
memory/1808-209-0x00007FF7FC2D0000-0x00007FF7FC4BF000-memory.dmp
memory/1808-155-0x000001E409690000-0x000001E4096F6000-memory.dmp
memory/1808-157-0x00007FF7FC2D0000-0x00007FF7FC4BF000-memory.dmp
memory/1808-156-0x000001E409690000-0x000001E4096F6000-memory.dmp
memory/1908-49-0x000001B782D20000-0x000001B782EA9000-memory.dmp
memory/1908-50-0x000001B782F80000-0x000001B782FE6000-memory.dmp
memory/1908-51-0x000001B782F80000-0x000001B782FE6000-memory.dmp
memory/2356-15-0x00007FF67AE10000-0x00007FF67AEF6000-memory.dmp
memory/2356-16-0x000001F9188E0000-0x000001F918946000-memory.dmp
memory/2356-55-0x00007FF67AE10000-0x00007FF67AEF6000-memory.dmp
memory/2356-18-0x000001F9188E0000-0x000001F918946000-memory.dmp
memory/2392-33-0x0000000000AB4000-0x0000000000AB5000-memory.dmp
memory/2392-0-0x00000000009C0000-0x0000000000C6D000-memory.dmp
memory/2392-7-0x00000000026C0000-0x0000000002729000-memory.dmp
memory/2392-1-0x00000000026C0000-0x0000000002729000-memory.dmp
memory/2392-200-0x00000000009C0000-0x0000000000C6D000-memory.dmp
memory/2392-39-0x00000000009C0000-0x0000000000C6D000-memory.dmp
memory/2472-93-0x000001E3182E0000-0x000001E318346000-memory.dmp
memory/2472-91-0x000001E318150000-0x000001E3182D9000-memory.dmp
memory/2472-92-0x000001E3182E0000-0x000001E318346000-memory.dmp
memory/2544-172-0x00007FF7E6230000-0x00007FF7E6376000-memory.dmp
memory/2544-100-0x0000024575300000-0x0000024575366000-memory.dmp
memory/2544-99-0x00007FF7E6230000-0x00007FF7E6376000-memory.dmp
memory/2544-101-0x0000024575300000-0x0000024575366000-memory.dmp
memory/2600-40-0x0000024185740000-0x00000241857A6000-memory.dmp
memory/2600-46-0x00007FF7529E0000-0x00007FF752C6A000-memory.dmp
memory/2600-44-0x0000024185740000-0x00000241857A6000-memory.dmp
memory/2600-37-0x0000024185740000-0x00000241857A6000-memory.dmp
memory/2600-36-0x00007FF7529E0000-0x00007FF752C6A000-memory.dmp
memory/2848-216-0x00000271A58F0000-0x00000271A5956000-memory.dmp
memory/2848-193-0x00007FF6B0D40000-0x00007FF6B116B000-memory.dmp
memory/2848-129-0x00007FF6B0D40000-0x00007FF6B116B000-memory.dmp
memory/2848-127-0x00000271A58F0000-0x00000271A5956000-memory.dmp
memory/2848-128-0x00000271A58F0000-0x00000271A5956000-memory.dmp
memory/2848-218-0x00007FF6B0D40000-0x00007FF6B116B000-memory.dmp
memory/2952-124-0x00007FF6A6380000-0x00007FF6A642A000-memory.dmp
memory/2952-118-0x00000233C9B30000-0x00000233C9B96000-memory.dmp
memory/2952-119-0x00000233C9B30000-0x00000233C9B96000-memory.dmp
memory/2964-166-0x00007FF60D700000-0x00007FF60D891000-memory.dmp
memory/2964-165-0x000001B683220000-0x000001B683286000-memory.dmp
memory/2964-164-0x000001B683220000-0x000001B683286000-memory.dmp
memory/2964-219-0x00007FF60D700000-0x00007FF60D891000-memory.dmp
memory/3244-230-0x00007FF7506F0000-0x00007FF750C1A000-memory.dmp
memory/3244-210-0x00000171C85D0000-0x00000171C8636000-memory.dmp
memory/3244-211-0x00000171C85D0000-0x00000171C8636000-memory.dmp
memory/3244-212-0x00007FF7506F0000-0x00007FF750C1A000-memory.dmp
memory/3748-179-0x0000021BF2AF0000-0x0000021BF2B56000-memory.dmp
memory/3748-182-0x00007FF621AE0000-0x00007FF621ECF000-memory.dmp
memory/3748-174-0x0000021BF2AF0000-0x0000021BF2B56000-memory.dmp
memory/3748-181-0x00007FF621AE0000-0x00007FF621ECF000-memory.dmp
memory/3748-175-0x0000021BF2AF0000-0x0000021BF2B56000-memory.dmp
memory/4292-173-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4292-107-0x00000000008F0000-0x0000000000959000-memory.dmp
memory/4292-123-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4292-112-0x00000000008F0000-0x0000000000959000-memory.dmp
memory/4568-26-0x0000020B9D440000-0x0000020B9D4A6000-memory.dmp
memory/4568-28-0x00007FF6944C0000-0x00007FF6945A6000-memory.dmp
memory/4568-29-0x0000020B9D440000-0x0000020B9D4A6000-memory.dmp
memory/4568-78-0x00007FF6944C0000-0x00007FF6945A6000-memory.dmp
memory/4932-189-0x000002029B7C0000-0x000002029B826000-memory.dmp
memory/4932-194-0x00007FF6C9430000-0x00007FF6C98FA000-memory.dmp
memory/4932-188-0x000002029B7C0000-0x000002029B826000-memory.dmp
memory/4932-229-0x00007FF6C9430000-0x00007FF6C98FA000-memory.dmp
memory/5028-80-0x0000012EBBCA0000-0x0000012EBBD06000-memory.dmp
memory/5028-79-0x00007FF67B440000-0x00007FF67B556000-memory.dmp
memory/5028-81-0x0000012EBBCA0000-0x0000012EBBD06000-memory.dmp
memory/5028-163-0x00007FF67B440000-0x00007FF67B556000-memory.dmp
memory/5080-73-0x00000295EA5D0000-0x00000295EA636000-memory.dmp
memory/5080-67-0x00000295EA5D0000-0x00000295EA636000-memory.dmp
memory/5080-68-0x00000295EA5D0000-0x00000295EA636000-memory.dmp
memory/5080-66-0x00007FF637590000-0x00007FF6376F8000-memory.dmp
memory/5080-75-0x00007FF637590000-0x00007FF6376F8000-memory.dmp