Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 03:06
General
- Target 2026-07-20_5d30024f9a7e1903dea0f62377d5cc99_elex_mafia.exe
- Size 873KB
- Sample260720-dl3yhsf19x
- SHA256 0700a1f64dd1322d2d0f77f96a3aad174012d8dfa5c0053be1e6fa5116aa6336
Malware Config
Signatures
- Executes dropped EXE 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 32 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5d30024f9a7e1903dea0f62377d5cc99_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5d30024f9a7e1903dea0f62377d5cc99_elex_mafia.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
MsSense.exe
dotnet.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/1236-89-0x00000239F8F30000-0x00000239F8F96000-memory.dmp
memory/1236-90-0x00000239F8F30000-0x00000239F8F96000-memory.dmp
memory/1236-88-0x00000239F8CE0000-0x00000239F8DA1000-memory.dmp
memory/1412-106-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/1412-112-0x0000000000910000-0x0000000000979000-memory.dmp
memory/1412-199-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/1412-107-0x0000000000910000-0x0000000000979000-memory.dmp
memory/1576-99-0x00000252CCC30000-0x00000252CCC96000-memory.dmp
memory/1576-96-0x00007FF629190000-0x00007FF6292D9000-memory.dmp
memory/1576-98-0x00000252CCC30000-0x00000252CCC96000-memory.dmp
memory/1576-179-0x00007FF629190000-0x00007FF6292D9000-memory.dmp
memory/2060-7-0x0000000002F40000-0x0000000002FA9000-memory.dmp
memory/2060-193-0x0000000000040000-0x00000000002EB000-memory.dmp
memory/2060-0-0x0000000000040000-0x00000000002EB000-memory.dmp
memory/2060-1-0x0000000002F40000-0x0000000002FA9000-memory.dmp
memory/2060-23-0x0000000000133000-0x0000000000134000-memory.dmp
memory/2060-6-0x0000000002F40000-0x0000000002FA9000-memory.dmp
memory/2060-38-0x0000000000040000-0x00000000002EB000-memory.dmp
memory/2068-72-0x000002328D310000-0x000002328D376000-memory.dmp
memory/2068-73-0x00007FF7DD300000-0x00007FF7DD467000-memory.dmp
memory/2068-65-0x000002328D310000-0x000002328D376000-memory.dmp
memory/2068-64-0x000002328D310000-0x000002328D376000-memory.dmp
memory/2068-63-0x00007FF7DD300000-0x00007FF7DD467000-memory.dmp
memory/2472-52-0x00007FF7A5560000-0x00007FF7A5682000-memory.dmp
memory/2472-16-0x00000231B0030000-0x00000231B0096000-memory.dmp
memory/2472-17-0x00000231B0030000-0x00000231B0096000-memory.dmp
memory/2472-18-0x00000231B0030000-0x00000231B0096000-memory.dmp
memory/2472-15-0x00007FF7A5560000-0x00007FF7A5682000-memory.dmp
memory/2612-55-0x0000024060000000-0x00000240600C1000-memory.dmp
memory/2612-56-0x00000240601F0000-0x0000024060256000-memory.dmp
memory/2612-57-0x00000240601F0000-0x0000024060256000-memory.dmp
memory/2980-145-0x00007FF7EB290000-0x00007FF7EB343000-memory.dmp
memory/2980-146-0x0000029CE7240000-0x0000029CE72A6000-memory.dmp
memory/2980-147-0x0000029CE7240000-0x0000029CE72A6000-memory.dmp
memory/2980-219-0x00007FF7EB290000-0x00007FF7EB343000-memory.dmp
memory/3016-184-0x0000021AE75F0000-0x0000021AE7656000-memory.dmp
memory/3016-180-0x0000021AE75F0000-0x0000021AE7656000-memory.dmp
memory/3016-181-0x00007FF730760000-0x00007FF7309EA000-memory.dmp
memory/3016-225-0x00007FF730760000-0x00007FF7309EA000-memory.dmp
memory/3388-156-0x000001F62D220000-0x000001F62D286000-memory.dmp
memory/3388-154-0x00007FF63D970000-0x00007FF63DC12000-memory.dmp
memory/3388-155-0x000001F62D220000-0x000001F62D286000-memory.dmp
memory/3388-220-0x00007FF63D970000-0x00007FF63DC12000-memory.dmp
memory/3640-345-0x00000263581E0000-0x0000026358246000-memory.dmp
memory/3640-118-0x00007FF76DA00000-0x00007FF76E143000-memory.dmp
memory/3640-120-0x00000263581E0000-0x0000026358246000-memory.dmp
memory/3640-212-0x00007FF76DA00000-0x00007FF76E143000-memory.dmp
memory/3640-119-0x00000263581E0000-0x0000026358246000-memory.dmp
memory/3640-347-0x00007FF76DA00000-0x00007FF76E143000-memory.dmp
memory/3748-162-0x00007FF7BFD10000-0x00007FF7BFEA4000-memory.dmp
memory/3748-224-0x00007FF7BFD10000-0x00007FF7BFEA4000-memory.dmp
memory/3748-163-0x00000263DB5C0000-0x00000263DB626000-memory.dmp
memory/3748-164-0x00000263DB5C0000-0x00000263DB626000-memory.dmp
memory/4360-126-0x00007FF7EBD00000-0x00007FF7EBDAD000-memory.dmp
memory/4360-128-0x000001A6CFA40000-0x000001A6CFAA6000-memory.dmp
memory/4360-127-0x000001A6CFA40000-0x000001A6CFAA6000-memory.dmp
memory/4360-214-0x00007FF7EBD00000-0x00007FF7EBDAD000-memory.dmp
memory/4504-75-0x00007FF7DE540000-0x00007FF7DE608000-memory.dmp
memory/4504-30-0x0000023763E30000-0x0000023763E96000-memory.dmp
memory/4504-28-0x0000023763E30000-0x0000023763E96000-memory.dmp
memory/4504-29-0x0000023763E30000-0x0000023763E96000-memory.dmp
memory/4504-27-0x00007FF7DE540000-0x00007FF7DE608000-memory.dmp
memory/4828-78-0x000001BB10CA0000-0x000001BB10D06000-memory.dmp
memory/4828-170-0x00007FF61AAA0000-0x00007FF61ABB9000-memory.dmp
memory/4828-77-0x000001BB10CA0000-0x000001BB10D06000-memory.dmp
memory/4828-76-0x00007FF61AAA0000-0x00007FF61ABB9000-memory.dmp
memory/4908-188-0x00007FF7F0860000-0x00007FF7F0B80000-memory.dmp
memory/4908-182-0x000002242CE30000-0x000002242CE96000-memory.dmp
memory/4908-171-0x00007FF7F0860000-0x00007FF7F0B80000-memory.dmp
memory/4908-172-0x000002242CE30000-0x000002242CE96000-memory.dmp
memory/4908-173-0x000002242CE30000-0x000002242CE96000-memory.dmp
memory/5384-46-0x0000022551A90000-0x0000022551B51000-memory.dmp
memory/5384-48-0x0000022551C50000-0x0000022551CB6000-memory.dmp
memory/5384-47-0x0000022551C50000-0x0000022551CB6000-memory.dmp
memory/5472-40-0x0000019C4D2C0000-0x0000019C4D326000-memory.dmp
memory/5472-37-0x0000019C4D2C0000-0x0000019C4D326000-memory.dmp
memory/5472-36-0x00007FF7DE540000-0x00007FF7DE608000-memory.dmp
memory/5472-39-0x0000019C4D2C0000-0x0000019C4D326000-memory.dmp
memory/5472-105-0x00007FF7DE540000-0x00007FF7DE608000-memory.dmp
memory/5544-135-0x000001A56DE90000-0x000001A56DEF6000-memory.dmp
memory/5544-137-0x000001A56DE90000-0x000001A56DEF6000-memory.dmp
memory/5544-216-0x00007FF7C5C80000-0x00007FF7C6096000-memory.dmp
memory/5544-136-0x00007FF7C5C80000-0x00007FF7C6096000-memory.dmp
memory/5544-223-0x00007FF7C5C80000-0x00007FF7C6096000-memory.dmp
memory/5544-221-0x000001A56DE90000-0x000001A56DEF6000-memory.dmp
memory/5924-203-0x0000023B44640000-0x0000023B446A6000-memory.dmp
memory/5924-202-0x0000023B44640000-0x0000023B446A6000-memory.dmp
memory/5924-226-0x00007FF7EE850000-0x00007FF7EED20000-memory.dmp
memory/5924-204-0x00007FF7EE850000-0x00007FF7EED20000-memory.dmp