493c698a3c944e27622fd49a4987a0e8595420d626e51f2584a7cf687525edb6

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_6e529ac14ae0008e77cd61c13e41e03d_elex_mafia.exe
Size 446KB
Sample260802-djpccashqd
SHA256 493c698a3c944e27622fd49a4987a0e8595420d626e51f2584a7cf687525edb6
MD5 6e529ac14ae0008e77cd61c13e41e03d
SHA1 3ccbb9fa350c80b03335fc07772e316bde7615fc
SHA512 f2835f0eb05768f42f7433cdecc04ab68ae9346cac39cbd76560afd9ce3cf45f2f64db0aa8c86c5fc64b756eec36baf98cce0346d1b144f6671caf719f8f513b
SSDEEP 6144:CRGHlDbXz9AicTO/JvG/pdJFVUB2HxPEb4PqgpYwG85YBsqocP+OKBP:C4xgMJvG/pdJFV4wqgpNG+YB1P+hh
TLSH
T11CA4DF107281C036E6D305345B65CB66597E3E660B62A8C73BD427AE6EB17C3EB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2372	3D1F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2372	3D1F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_6e529ac14ae0008e77cd61c13e41e03d_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D1F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2372	3D1F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2372	3564	2026-08-02_6e529ac14ae0008e77cd61c13e41e03d_elex_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_6e529ac14ae0008e77cd61c13e41e03d_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6e529ac14ae0008e77cd61c13e41e03d_elex_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\3D1F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3D1F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_6e529ac14ae0008e77cd61c13e41e03d_elex_mafia.exe C6E638C8A054AF62BBE94EA6061768A5098CFD22302E4AEFC8C7A2B965DD8308A463CA6F161084A6B4920B8416EEC722EFDAD241EC4867394AB3F771F51A71AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D1F.tmp
Size 446KB
SHA256 55579ef97b45e91dae93864ca53933cee83d9b341884467a02d2fe9068db3fb6
MD5 308b8163c068a203cd4f923b4ca6862e
SHA1 54a7030e9282cf62afca493ca1783fc35146c336
SHA512 f68318dd61aa5db7b9011df8770159703cec068dddb5257dcbc3038938890180a74a285d168e6f105aa3b5a4733e4448790b1de9e4091abae7fd3fdea071d3bf
SSDEEP 12288:C4xgMJvG/pdJFVUySMpYXZBrJ0neHNb2GJrVSXLr:C4LJv0dJFSnxJDCebhJr
TLSH
T149A4E0143581C13AE6D309308A25DF56093F7E664772A8C72BD42AAE6EB47D3E739307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads