61759e7139dcec11de8f8465252c057985c27d92d0184a385bb4161f4c5c0ccb

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_e6f5a39a3e40fe74a63fb38b770c8ffa_elex_mafia_tofsee.exe
Size 262KB
Sample261014-dbm5baft4j
SHA256 61759e7139dcec11de8f8465252c057985c27d92d0184a385bb4161f4c5c0ccb
MD5 e6f5a39a3e40fe74a63fb38b770c8ffa
SHA1 2cafb25989036b4937eea3c9f5ff5ed033c0d322
SHA512 dc28249eb7dd28a02fed45b2a5afae9160d1c45713773a7c7fd3f262e0977d261d697998d4492daa8474d83bc2ca0f8394df2d0e1e0bf12c11b197082f17c7cc
SSDEEP 6144:jx9kwakmKtkzISpbgN2hzLAos/zqa7R0bMKPMtq:nkwX2zvgN2hzLAnzD0bMuMt
TLSH
T11E448C00F7E68036F52B29355CA6973D852AB8209F3897C7DB911F2EAF215D3897530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_e6f5a39a3e40fe74a63fb38b770c8ffa_elex_mafia_tofsee.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4328	2026-10-13_e6f5a39a3e40fe74a63fb38b770c8ffa_elex_mafia_tofsee.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4328	2026-10-13_e6f5a39a3e40fe74a63fb38b770c8ffa_elex_mafia_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-13_e6f5a39a3e40fe74a63fb38b770c8ffa_elex_mafia_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_e6f5a39a3e40fe74a63fb38b770c8ffa_elex_mafia_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 334B
SHA256 dffd08fd8c01ad01c5fc4e99b753293794f38f9a1878259b55e5b1c6c0a67991
MD5 4e19d331cf584cc0174db89c95d82e01
SHA1 421801167e89559ad279210c573cd7ec8f4e48a1
SHA512 31b696e0ef69fad96ccf57cbe2efb2737aab50b095feb90a7b5d4720e1d7eeaa59ab73afaa835d0cab79159a46d56fcf1247062a36ed89df00fc9021f014c0d5
TLSH
T1D4E07D900E002552E0A6E598E9AA6FC0E0BAB05A88C154B9FF6887DE1ABD53C56D8107
MD5 SHA1 SHA512 TLSH

Submit Download