Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
11/05/2026, 16:51
General
- Target 2026-05-11_bfe91564ad89847b37169edae8354cd6_elex_mafia.exe
- Size 877KB
- Sample260511-vc9hdae15w
- SHA256 b02858583fc705f3b579e275e7f69880d4c664b4ec385e235dede78b96c6e8b2
Malware Config
Signatures
- Executes dropped EXE 17 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 29 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_bfe91564ad89847b37169edae8354cd6_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_bfe91564ad89847b37169edae8354cd6_elex_mafia.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
dotnet.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
alg.exe
msdtc.exe
snmptrap.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/944-17-0x00000115A9E30000-0x00000115A9E96000-memory.dmp
memory/944-16-0x00000115A9E30000-0x00000115A9E96000-memory.dmp
memory/944-14-0x00007FF61D660000-0x00007FF61D747000-memory.dmp
memory/944-15-0x00000115A9E30000-0x00000115A9E96000-memory.dmp
memory/944-94-0x00007FF61D660000-0x00007FF61D747000-memory.dmp
memory/1028-178-0x0000014A64770000-0x0000014A647D6000-memory.dmp
memory/1028-177-0x00007FF7C9310000-0x00007FF7C9739000-memory.dmp
memory/1028-185-0x00007FF7C9310000-0x00007FF7C9739000-memory.dmp
memory/1028-183-0x0000014A64770000-0x0000014A647D6000-memory.dmp
memory/1028-179-0x0000014A64770000-0x0000014A647D6000-memory.dmp
memory/1736-125-0x000001F189DA0000-0x000001F189E06000-memory.dmp
memory/1736-195-0x00007FF70E710000-0x00007FF70EB7D000-memory.dmp
memory/1736-203-0x000001F189DA0000-0x000001F189E06000-memory.dmp
memory/1736-204-0x00007FF70E710000-0x00007FF70EB7D000-memory.dmp
memory/1736-124-0x000001F189DA0000-0x000001F189E06000-memory.dmp
memory/1736-126-0x00007FF70E710000-0x00007FF70EB7D000-memory.dmp
memory/1772-152-0x000001CF82650000-0x000001CF826B6000-memory.dmp
memory/1772-207-0x000001CF82100000-0x000001CF8210C000-memory.dmp
memory/1772-205-0x00007FF75EBE0000-0x00007FF75EDCF000-memory.dmp
memory/1772-150-0x00007FF75EBE0000-0x00007FF75EDCF000-memory.dmp
memory/1772-151-0x000001CF82650000-0x000001CF826B6000-memory.dmp
memory/3296-103-0x00007FF726E50000-0x00007FF726F34000-memory.dmp
memory/3296-26-0x000002C41CF00000-0x000002C41CF66000-memory.dmp
memory/3296-25-0x000002C41CF00000-0x000002C41CF66000-memory.dmp
memory/3296-27-0x00007FF726E50000-0x00007FF726F34000-memory.dmp
memory/4040-200-0x00000000011E0000-0x000000000123F000-memory.dmp
memory/4040-110-0x0000000000690000-0x00000000006F9000-memory.dmp
memory/4040-105-0x0000000000690000-0x00000000006F9000-memory.dmp
memory/4040-104-0x0000000000400000-0x000000000054A000-memory.dmp
memory/4040-191-0x0000000000400000-0x000000000054A000-memory.dmp
memory/4156-1-0x0000000003090000-0x00000000030F9000-memory.dmp
memory/4156-31-0x00000000002E4000-0x00000000002E5000-memory.dmp
memory/4156-40-0x00000000001F0000-0x000000000049D000-memory.dmp
memory/4156-6-0x0000000003090000-0x00000000030F9000-memory.dmp
memory/4156-169-0x00000000001F0000-0x000000000049D000-memory.dmp
memory/4156-0-0x00000000001F0000-0x000000000049D000-memory.dmp
memory/4156-168-0x00000000017E0000-0x000000000189F000-memory.dmp
memory/4508-62-0x00007FF7AD680000-0x00007FF7AD7E8000-memory.dmp
memory/4508-71-0x00007FF7AD680000-0x00007FF7AD7E8000-memory.dmp
memory/4508-69-0x0000023491ED0000-0x0000023491F36000-memory.dmp
memory/4508-63-0x0000023491ED0000-0x0000023491F36000-memory.dmp
memory/4508-64-0x0000023491ED0000-0x0000023491F36000-memory.dmp
memory/4640-46-0x00000233BF7C0000-0x00000233BF8EF000-memory.dmp
memory/4640-48-0x00000233BFA10000-0x00000233BFA76000-memory.dmp
memory/4640-47-0x00000233BFA10000-0x00000233BFA76000-memory.dmp
memory/4716-141-0x00007FF752A20000-0x00007FF752D44000-memory.dmp
memory/4716-201-0x00007FF752A20000-0x00007FF752D44000-memory.dmp
memory/4716-142-0x000001B45AD50000-0x000001B45ADB6000-memory.dmp
memory/4716-143-0x000001B45AD50000-0x000001B45ADB6000-memory.dmp
memory/4732-54-0x0000025A10020000-0x0000025A1014F000-memory.dmp
memory/4732-56-0x0000025A10270000-0x0000025A102D6000-memory.dmp
memory/4732-55-0x0000025A10270000-0x0000025A102D6000-memory.dmp
memory/4964-97-0x000001E90A800000-0x000001E90A866000-memory.dmp
memory/4964-187-0x00007FF747DC0000-0x00007FF747EAA000-memory.dmp
memory/4964-95-0x00007FF747DC0000-0x00007FF747EAA000-memory.dmp
memory/4964-96-0x000001E90A800000-0x000001E90A866000-memory.dmp
memory/4996-86-0x00000249D8110000-0x00000249D823F000-memory.dmp
memory/4996-88-0x00000249D83B0000-0x00000249D8416000-memory.dmp
memory/4996-87-0x00000249D83B0000-0x00000249D8416000-memory.dmp
memory/5100-118-0x0000024D2EC00000-0x0000024D2EC66000-memory.dmp
memory/5100-194-0x00007FF7F4BD0000-0x00007FF7F4C78000-memory.dmp
memory/5100-116-0x00007FF7F4BD0000-0x00007FF7F4C78000-memory.dmp
memory/5100-117-0x0000024D2EC00000-0x0000024D2EC66000-memory.dmp
memory/5480-74-0x00007FF6D1B30000-0x00007FF6D1C44000-memory.dmp
memory/5480-75-0x00000224DD8A0000-0x00000224DD906000-memory.dmp
memory/5480-198-0x00000224DD3B0000-0x00000224DD3BC000-memory.dmp
memory/5480-176-0x00007FF6D1B30000-0x00007FF6D1C44000-memory.dmp
memory/5480-76-0x00000224DD8A0000-0x00000224DD906000-memory.dmp
memory/5572-206-0x00007FF69D6D0000-0x00007FF69D85F000-memory.dmp
memory/5572-159-0x000001413E6B0000-0x000001413E716000-memory.dmp
memory/5572-160-0x000001413E6B0000-0x000001413E716000-memory.dmp
memory/5572-158-0x00007FF69D6D0000-0x00007FF69D85F000-memory.dmp
memory/5616-199-0x00007FF7B7A30000-0x00007FF7B7ADB000-memory.dmp
memory/5616-135-0x000001B75A750000-0x000001B75A7B6000-memory.dmp
memory/5616-134-0x000001B75A750000-0x000001B75A7B6000-memory.dmp
memory/5616-133-0x00007FF7B7A30000-0x00007FF7B7ADB000-memory.dmp
memory/5720-36-0x000001432ED20000-0x000001432ED86000-memory.dmp
memory/5720-34-0x00007FF6E5CB0000-0x00007FF6E5F38000-memory.dmp
memory/5720-35-0x000001432ED20000-0x000001432ED86000-memory.dmp
memory/5720-41-0x000001432ED20000-0x000001432ED86000-memory.dmp
memory/5720-43-0x00007FF6E5CB0000-0x00007FF6E5F38000-memory.dmp