stealc | 4a9c85d70878ac95515200b4864e1671cb4c4dbeba76b914f79ae9e1094ac53a

Analysis

max time kernel
104s
max time network
106s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
18/04/2025, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

2.4MB
MD5

d482d7bc73f4825e5e14c70b39811a20
SHA1

812dc8578ba9e9d3572f5c043e0ab83146920ac8
SHA256

4a9c85d70878ac95515200b4864e1671cb4c4dbeba76b914f79ae9e1094ac53a
SHA512

18dbd13aa7921fb5b24b7437d120b338a307476cc0adbc021db43e2634ec38c3881decef97783eb9fc92c3ed2bacae631b3e1f6ca9d24c9b4502d34bddb8c041
SSDEEP

49152:lDN1CgL+XjcZ7VGTtcpKrjgMjE1MD+2kKrUywUt2KBQFvwCTwYC7SCB60vNJ:l7LLZ78tP/gogMD+FKrUywUoKBQhw5Yy

Score

10^/10

stealc suka stealer

Malware Config

Extracted

Family

stealc

Botnet

suka

45.93.20.28

Attributes

url_path
/3d15e67552d448ff.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks BIOS information in registry
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-1-0x00007FF6CA5B0000-0x00007FF6CAC3A000-memory.dmp

Filesize
6.5MB

Download
memory/1988-0-0x00007FF6CA5B0000-0x00007FF6CAC3A000-memory.dmp

Filesize
6.5MB

Download
memory/1988-2-0x00007FF6CA5B0000-0x00007FF6CAC3A000-memory.dmp

Filesize
6.5MB

Download