infected_stealer | d468d59ea330e48277fa1dd62eccb8d05b324eacb78b8bd1e54df0c9fb83d8f9

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/04/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d468d59ea330e48277fa1dd62eccb8d05b324eacb78b8bd1e54df0c9fb83d8f9.exe
Size 4.3MB
Sample260401-tedm2sg181
SHA256 d468d59ea330e48277fa1dd62eccb8d05b324eacb78b8bd1e54df0c9fb83d8f9
MD5 3af4ffcfa2426836921b002f88c01b26
SHA1 9597bd7e519ef238c72416bd4d4945dc6fa1e05b
SHA512 6ebccd91ef6af4ff8b896a45a3c16aa28a8e8fb737a598e856441b6c9e59f8c6aa4af05d3abea279566b8a1196d1f05cac25661b78f3c50cde981790c8bf0a29
SSDEEP 98304:PkjozJ9/im8XVBKl6tmJVPS47x/EaR5zNNHtFWIT4bNJFY3OqttIFe:XzJpjS346tmJ1xsG53tFWjBHYdIw
TLSH
T18D2612B032A4EA07E13A5E760971798793BD2F133513E39D289263CD1AF278506D2B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery infected_stealer stealer

Malware Config

Signatures

Detects InfectedStealer aka LocalStealer 1 IoCs

resource	yara_rule
behavioral2/memory/1064-0-0x00000000003E0000-0x0000000000836000-memory.dmp	family_infected_stealer

InfectedStealer,LocalStealer
InfectedStealer aka LocalStealer is a Windows modular stealer written in C#.
stealer infected_stealer
Infected_stealer family
infected_stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	1064	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d468d59ea330e48277fa1dd62eccb8d05b324eacb78b8bd1e54df0c9fb83d8f9.exe

C:\Users\Admin\AppData\Local\Temp\d468d59ea330e48277fa1dd62eccb8d05b324eacb78b8bd1e54df0c9fb83d8f9.exe
"C:\Users\Admin\AppData\Local\Temp\d468d59ea330e48277fa1dd62eccb8d05b324eacb78b8bd1e54df0c9fb83d8f9.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 956
  2⤵
  - Program crash
  PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1064 -ip 1064
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-0-0x00000000003E0000-0x0000000000836000-memory.dmp

Download

memory/1064-1-0x0000000005250000-0x000000000539D000-memory.dmp