stealc | bd934a2faea290adb6062c096144b374b18ce62f684b2a81f924c2511a286db3

Analysis

max time kernel
102s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

2.4MB
MD5

9e8f3cb26f25c3e799f0b90fe78d8422
SHA1

5f95d3551797553570f2c79ee6d3885a938d51af
SHA256

bd934a2faea290adb6062c096144b374b18ce62f684b2a81f924c2511a286db3
SHA512

79124f1f3940c087062490822e8c28cdb1e3c6e670fa6867af05cc0f970d2a0f6805addb090eb7672fd0eaed4b16e3b9085c8981c543e3e7419a6974ba9402f2
SSDEEP

49152:ewL5HBG654XebSeo55ytQPJqVDKE2olZPYN9P4IZ8Rhev06AeScxnNxxx:eUduebSdPSh2orYZYevbScxj

Score

10^/10

stealc suka stealer

Malware Config

Extracted

Family

stealc

Botnet

suka

45.93.20.28

Attributes

url_path
/3d15e67552d448ff.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks BIOS information in registry
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5716-0-0x00007FF71AB30000-0x00007FF71B1C9000-memory.dmp

Filesize
6.6MB

Download
memory/5716-1-0x00007FF89C8A7000-0x00007FF89C8A9000-memory.dmp

Filesize
8KB

Download
memory/5716-3-0x00007FF71AB30000-0x00007FF71B1C9000-memory.dmp

Filesize
6.6MB

Download