a91638c2e7f5f790c153f5d54e331df6e867b991e10565de9d2dadfa265a0232

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_a7857a41f85c1056f5f6ef0a733c9585_elex_mafia.exe
Size 446KB
Sample260806-bpap2abl91
SHA256 a91638c2e7f5f790c153f5d54e331df6e867b991e10565de9d2dadfa265a0232
MD5 a7857a41f85c1056f5f6ef0a733c9585
SHA1 f080288cb795f03ec8f5576f14355c83334bf779
SHA512 99cab5860f8d5fb7c7b4f75469cd4b6a060ea9f87110033fc1159c66f194ebf7286353666d25894874662471678837cc2c69001786d2bfb0b4df09085467ce12
SSDEEP 12288:C4xgMJvG/pdJFVFB1oab3Ems8I4rt0GhmHjq:C4LJv0dJFXBSyPre9D
TLSH
T1A2A4D0247281C136E29305359A26DB56593E39750B72A8D73BD42BEE2E707C3EB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1004	F7E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
1004	F7E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_a7857a41f85c1056f5f6ef0a733c9585_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F7E8.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1004	F7E8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1004	2128	2026-08-06_a7857a41f85c1056f5f6ef0a733c9585_elex_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a7857a41f85c1056f5f6ef0a733c9585_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a7857a41f85c1056f5f6ef0a733c9585_elex_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\F7E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\F7E8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-06_a7857a41f85c1056f5f6ef0a733c9585_elex_mafia.exe 213C8CBAD4CA7593D9A2A081E733EBD446D76D3625F5B6703F279109757B6185547EE0BCDFC346D074849C0B7D0AEFE6C847B5173B4ED9FDCD9C360E7A09B6A5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F7E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\F7E8.tmp
Size 446KB
SHA256 251f24a32be376c40015935e4e889ba2faa01aabe2ab8345517906e74cbaada4
MD5 463cad10134b267460287e7bbe47ae1d
SHA1 750fd7b9be83e589121e398cfbdedb2522e8893f
SHA512 8e4f192d8c539eb3b3d1e85f88fa82282939d4bb49cce907a24507a0752ab002b85bd4a92bafb6fa4a0b85279cd8ed8baefd8e15f4491bf29a5ed87eaf797f3b
SSDEEP 6144:CRGHlDbXz9AicTO/JvG/pdJFVUBHLJ6BOimTkjpN3AaWc9wJDP:C4xgMJvG/pdJFVgMOiioWaWswJ
TLSH
T1CFA4D0207681C036E69304345B65DF52597E3DA54B22A8DB2BD42BEE2E703D3EB39317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads