b8c0a903182dc6fda5b4fccf9fdbf93a123eac6d0efad2344a5e1d7692bc864f

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_449bfe252d76f77f45085b112f94f85b_elex_icedid_mafia_njrat_stealc_tofsee.exe
Size 807KB
Sample260702-wekgpsbs2x
SHA256 b8c0a903182dc6fda5b4fccf9fdbf93a123eac6d0efad2344a5e1d7692bc864f
MD5 449bfe252d76f77f45085b112f94f85b
SHA1 b8efe0a7036ab4381f1f758d043992ecc938cd47
SHA512 b7e898a3b12e9274e30089cad3f68f9bc05d669c18fef4ecd655f0471a8b3e56866f4823b6f07fb4e9f88aa3cdfdd533f18431ce7525bc7c02a54baa9b2afec6
SSDEEP 12288:6O4rfItL8HP9kzuTp7nD755ifxOx7rKxtgCYXhW:6O4rQtGP9kzAnD755i5U3KxBYXhW
TLSH
T16305AFD967CEC2F5F651033409E18300F7B2FCE91A919E9F54E8223B5D6A4C6EF61226
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1408	CB88.tmp

Executes dropped EXE 1 IoCs

pid	Process
1408	CB88.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_449bfe252d76f77f45085b112f94f85b_elex_icedid_mafia_njrat_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB88.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 1408	5144	2026-07-02_449bfe252d76f77f45085b112f94f85b_elex_icedid_mafia_njrat_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_449bfe252d76f77f45085b112f94f85b_elex_icedid_mafia_njrat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_449bfe252d76f77f45085b112f94f85b_elex_icedid_mafia_njrat_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Users\Admin\AppData\Local\Temp\CB88.tmp
  "C:\Users\Admin\AppData\Local\Temp\CB88.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_449bfe252d76f77f45085b112f94f85b_elex_icedid_mafia_njrat_stealc_tofsee.exe 04BD02DB3C3087077CC7B87BA34BB9F1D53F75DD4250CBE63B61BC22F8995E4740D461509A095A8B886DF7943AEB9831DDFBF702A44AFA6B88D9D03574AEE92D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CB88.tmp

Path C:\Users\Admin\AppData\Local\Temp\CB88.tmp
Size 807KB
SHA256 4cf378a1c9d9b14bb53fc2c9643c674f2bc11142c886cfaacd1ff6c7073b9eed
MD5 5d962f427137c268c0aaf5c6e57a59f3
SHA1 dd70d7f6168cd8f9638a8b9dd786117f9dd1495d
SHA512 638e4a64395af48dc9d500950bfa9397298585103bea01f61c6c88248906c9f3fc0e93f3650ed2efc480062c9168250b6cdb61b48161f1a9609f6c3d449abcfd
SSDEEP 12288:6O4rfItL8HPZ+SjIK2de+voK9v4VrwynVOr7rKxtgCYXhW:6O4rQtGPZ+feBCvAwyAr3KxBYXhW
TLSH
T16705AE9967CEC2F5F651033409E18340B7B2FCE91A519E9F50E8213F6D6A8C6EF71226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download