c49c0832d23b68efec0a657040f6ddcb394784c1e62f72537eada12d75f478ac

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_b323a51a9fad455afc5ccf46c260080c_elex_mafia.exe
Size 446KB
Sample260802-c7tfjacb27
SHA256 c49c0832d23b68efec0a657040f6ddcb394784c1e62f72537eada12d75f478ac
MD5 b323a51a9fad455afc5ccf46c260080c
SHA1 89bcc8e365ff48861c31d0316f5815067aa548fd
SHA512 58d5ae632a16521a1516937d51e4e0a771cc57f500b8c921e9735cb0eb403cc463ff360dd606a814f61b39a1825d2ecc845186b905fd4612e30b19c67f4fe5c1
SSDEEP 6144:CRGHlDbXz9AicTO/JvG/pdJFVUBiBWRfssa+n8ZcPv4ogb0qsPvXYBv1QP:C4xgMJvG/pdJFVUssP2c4I7PvX8vG
TLSH
T115A4E0107681C03AE2D305359B66DBA6193E79750732A8C76BD42AEE6E703C3EB35317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3040	6F1B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3040	6F1B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_b323a51a9fad455afc5ccf46c260080c_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6F1B.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3040	6F1B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3040	4316	2026-08-02_b323a51a9fad455afc5ccf46c260080c_elex_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_b323a51a9fad455afc5ccf46c260080c_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b323a51a9fad455afc5ccf46c260080c_elex_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\6F1B.tmp
  "C:\Users\Admin\AppData\Local\Temp\6F1B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_b323a51a9fad455afc5ccf46c260080c_elex_mafia.exe F775596FF3FADAC93F036AFC0FA1078E09112770BCB043A843557D77D112341763A100612E8B858C9035D88AAA13CB3B05671F32038F61CA9AFC702431334454
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6F1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\6F1B.tmp
Size 446KB
SHA256 1e353b243bf7dfe11face3290f9c8d347dc78eff27ccf2c0a7934f3c6e7a4269
MD5 112e163722a444373d6cbd3676a57bc2
SHA1 f3f56c446c04fd5270c7e278a956aa5e212f7b42
SHA512 6ab6aa9c916f3777ed35ef03f90b12023e1841434a7e34e430e9b2a12494c9fd4bf31940991a0e9005f2496a1126a86099e1eab31497757627d7723d6262f17f
SSDEEP 6144:CRGHlDbXz9AicTO/JvG/pdJFVUBdY2Mhq70iHDuVltcBSs0AKDCdDRXKuWbxxgiP:C4xgMJvG/pdJFVNMY6DuVYBSYdDSx+6
TLSH
T123A4E0207184C036E6A301359B69CB62443E7D755B72A8C77BD41AAE6E753D3EB3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads