Overview

overview

7

Static

static

3

2026-08-09...ee.exe

windows10-2004-x64

7

2026-08-09...ee.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 04:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee.exe
  • Size 95.1MB
  • Sample260809-ffslps1ald
  • SHA256 e3784913470591a832e6a530801f8a02dcbc2663326c81c2107dee52e5bec750
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2884

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HabibiConsole.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\HabibiConsole.dll
        • Size 1.9MB
        • SHA256 90d5ba9b2d17bb5206f27f2b7c088c308a1011358304d6b3f686270b1b92d21d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.SystemEvents.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\Microsoft.Win32.SystemEvents.dll
        • Size 93KB
        • SHA256 b198c6233a20f5f4fa8f6ded9d368b48f2471990265ef5d458174b31aaf618a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Collections.Concurrent.dll
        • Size 269KB
        • SHA256 e7118198a3a8b22ca39685a273d05db7b4f6c73e35d8d4ce462f66173e61fa53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Immutable.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Collections.Immutable.dll
        • Size 817KB
        • SHA256 ba92cfa66bc95e7127f0ec88f453708986a9589f1397167fe697649b08f91d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Collections.NonGeneric.dll
        • Size 101KB
        • SHA256 9d9f9e4fd5ff8f56a86d867a54927705fa77d6c3e0ed94c2a52112f3ec4193bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Collections.Specialized.dll
        • Size 101KB
        • SHA256 31e89caf6d21a20acc8ebbd390dd74d6c1340fae3a4abcf24bbf5dfef714a67d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Collections.dll
        • Size 253KB
        • SHA256 0937f7983c191dbb768c51bb9ae90621575c0a2cc3b185d85e31ac2f87001af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.EventBasedAsync.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.ComponentModel.EventBasedAsync.dll
        • Size 45KB
        • SHA256 f022e0b45685fac64695ea127c51f380e1d81fe4f97306de20883c1151fb6d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 7ace9d079c895f11c8afe54e420c8ca3a361e7fd7429b333a629094b08f73432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.TypeConverter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.ComponentModel.TypeConverter.dll
        • Size 729KB
        • SHA256 6ffa8c5934389ad34c0b840b87fefd44fc7605b5215b3188010f2cbc71969f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.ComponentModel.dll
        • Size 29KB
        • SHA256 d0d5df86a307db3f7d0d59a39664c04f4fbb581103b6a89aa21395cd3f707af8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Diagnostics.Process.dll
        • Size 329KB
        • SHA256 5e7871e795a2c833fce3b0d02373f672ecdafdaaebd1f459a7e714ac498af428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.StackTrace.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Diagnostics.StackTrace.dll
        • Size 45KB
        • SHA256 a035326a73e9d98862813d6be278cab8b43ca7d5cc22002014421d18b0860a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.TraceSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Diagnostics.TraceSource.dll
        • Size 141KB
        • SHA256 b1b02e2cb4cd17187c3825f28bec194ea0ee031f87a5cd97656efba3aad758b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Common.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Drawing.Common.dll
        • Size 1.5MB
        • SHA256 7d0a72700584d79d88b0d192e5ec16c7292cf6b829652743e65a55caf5400a3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Drawing.Primitives.dll
        • Size 129KB
        • SHA256 f7f5ab9f1e8b2dc14e5bbdf1b606a91dd57b8882cd289a68e85ef6e69ccdacf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Memory.dll
        • Size 153KB
        • SHA256 fd29c91ec1ae5ec2d98ad77f2863da6d583a3be596a1813959d02877cde057a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.ObjectModel.dll
        • Size 77KB
        • SHA256 e21ff10bdf7f9f1c035d9ab1bebde797611061bf50f9a4f42e8f370a3a8e859a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Private.CoreLib.dll
        • Size 12.6MB
        • SHA256 8c01f630bb23c2fb142e6559cdcdf147105625defb36107019d4ab50d8854cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Reflection.Metadata.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Reflection.Metadata.dll
        • Size 1.1MB
        • SHA256 7e45d32c6b8d8caf3c782357c9d18fbbcb98adc715007841ece2360e985b6d67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Resources.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Resources.Extensions.dll
        • Size 133KB
        • SHA256 2f1f7c0f4a94be5015930a918148e89a40a83b83c10e2655254219f3a30bb99c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Runtime.InteropServices.dll
        • Size 93KB
        • SHA256 570a8140b838042a5d1135d5a20e39d18ccbfce13395c73b0b5bea935d311ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Threading.dll
        • Size 81KB
        • SHA256 baad7f0d2f3ef9a7b4ed7646093464edddbee0937f33de71be139a01a86375ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Windows.Forms.Primitives.dll
        • Size 2.9MB
        • SHA256 1d18d1c91113ab6136e8960134febd0c4b8b3ea8a4e7e421a811578a2028651f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-08-09_e2aea7401886735c08d0f3ec13261167_hijackloader_stealc_stop_tofsee\quiRWBGAYuds7geK2j90zg9m4qEYWKg=\System.Windows.Forms.dll
        • Size 12.9MB
        • SHA256 7fa81901e23e79bd66601e82e84d5b48920f0cf4a480610b96e0f7fb05fb52b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download