2a90905ab89753cbd341b3b8afbf045cb059d565187238fd4d316a3a8e41f40a

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_b9e6cd2a3eb0af6ba753fd96c06b5a51_elex_mafia.exe
Size 446KB
Sample260728-15fcwsap6t
SHA256 2a90905ab89753cbd341b3b8afbf045cb059d565187238fd4d316a3a8e41f40a
MD5 b9e6cd2a3eb0af6ba753fd96c06b5a51
SHA1 cde0fe9c1d3bfca9bc1f47c8c6fd070e82194d59
SHA512 cca794075e35ac0ea9f0dbd8b63251234b17f9da801cee34f7ed22275b42ca024b3ce0915c627321c1c496d9d15b99eecbd519f09dbbf7474e0589df501e7cb7
SSDEEP 12288:kkVkKHq/WY3qQgEq5LKt5zD4y+jrMFB1qH:kk7HqXaQgl52RD4y9FB
TLSH
T167A4D0197281C036D5A315308B26DBA2153A3D315B7168CBB7D43B7F6FB4AD1AA7830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5772	31A5.tmp

Executes dropped EXE 1 IoCs

pid	Process
5772	31A5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_b9e6cd2a3eb0af6ba753fd96c06b5a51_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31A5.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5772	31A5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 5772	4272	2026-07-28_b9e6cd2a3eb0af6ba753fd96c06b5a51_elex_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_b9e6cd2a3eb0af6ba753fd96c06b5a51_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_b9e6cd2a3eb0af6ba753fd96c06b5a51_elex_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\31A5.tmp
  "C:\Users\Admin\AppData\Local\Temp\31A5.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-28_b9e6cd2a3eb0af6ba753fd96c06b5a51_elex_mafia.exe 00ABEE49809AB8D52BF3851E3318C474F70DBE564BB7544A910AAEA78ADD6B2969C081B6E917EC7FBC764ADA698903939165AB3F0C35199E9E758D8816CDC148
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\31A5.tmp
Size 446KB
SHA256 ee3e18a2b8b5a6d0bad993bf32eca29250087d21cb31fabc248c71c35ae1d1d0
MD5 3f47b3d4b21a94ad0d350532d01a40b1
SHA1 4c8a5f10a2fbf0e9b86255d4e34921007e98535d
SHA512 985ff9610e2430c4fc9841339f022d40a3853cc48ad631a0e951b8343754b6ab2f75f43ebd3aea326b1883350326b643ec033cc609c92fa3116ba0b7c8e0d5e4
SSDEEP 6144:kg1hrWnlakRt85qUhrzq/WY3qaHgbtjyMZgOwAKJjIpY3tP6HRoQk1qH:kkVkKHq/WY3q5yMZg2KJjN3tixQ1qH
TLSH
T1D5A4D02872C1C036E5A300318B66D7A2543A7D355B7168CBB7D83A7F6F74AD1A63831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads