c0fed210ae0236b381a1f16873615554e3f81e990d6524c4283bfc4b14ef22f2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0b4c9e4520f616d12d90d8da01ec4364_elex_mafia_magniber_njrat_stealc_tofsee.exe
Size 779KB
Sample260816-sth1msdp21
SHA256 c0fed210ae0236b381a1f16873615554e3f81e990d6524c4283bfc4b14ef22f2
MD5 0b4c9e4520f616d12d90d8da01ec4364
SHA1 033197352577124f081abcccf959d8ee70fea176
SHA512 1df0d7a7dc03b525e36cb08dc83d282ee57f272b73929707d905bc29924ab1af6311f967b73861b7d5a7eaba1fde37f6c4952b9feba88fa0987cfcb9a0c476b1
SSDEEP 12288:PZLolhNVyERFSMXcidZX8RYimx9/g1qEPSmtUw:PZqhOERFSGpZX8MW
TLSH
T1E7059ED9D78EC0F5F65102300AF08310B7B2FCE91B519E5FA1E8323B6DA94C5BE65626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3628	7078.tmp

Executes dropped EXE 1 IoCs

pid	Process
3628	7078.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_0b4c9e4520f616d12d90d8da01ec4364_elex_mafia_magniber_njrat_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7078.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3628	7078.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3628	4336	2026-08-16_0b4c9e4520f616d12d90d8da01ec4364_elex_mafia_magniber_njrat_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-16_0b4c9e4520f616d12d90d8da01ec4364_elex_mafia_magniber_njrat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0b4c9e4520f616d12d90d8da01ec4364_elex_mafia_magniber_njrat_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\7078.tmp
  "C:\Users\Admin\AppData\Local\Temp\7078.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-16_0b4c9e4520f616d12d90d8da01ec4364_elex_mafia_magniber_njrat_stealc_tofsee.exe 4AC0190785937E9027F55A5591437EBE3FC6DAE4874F1432DAF8BA326992923918506CD3ED8C21A541EBE141965571549F5E6154DB7FFBF3823997588A6E7AC8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7078.tmp

Path C:\Users\Admin\AppData\Local\Temp\7078.tmp
Size 779KB
SHA256 90a0b020725eefe72a0cb7bd90120116deec20ca93de9809bff7902409ac46da
MD5 1314003fd96f2a65f82e7099f0f22d7c
SHA1 1f962204e17163471818b3b5fa0d053abdbf1086
SHA512 3d0c961551b9dd8da23224372f10853dfafecd14236fde3178b65fd50f561ac9448aedee6c0add27da2b447dbff316273b694b1075e13dc35033a3212e0f1ad2
SSDEEP 6144:PVdvczEb7GUOpYWhNVynE/mFu+j2nxnoCSwI0sezZkTm7bxdqEPrmmtaihDNCXba:PZLolhNVyEZGp7ezZJPqEPSmtUw
TLSH
T1B405AEE5978EC1F5F65102300AF08311B7B2FCE81B519E5FA1E9323B6CA94C5FE65226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads