stealc | 2e6129b0aa7aed4e1161b9e09d14a2f5637cfd426e97fce1e95b0bee7ac28826

Analysis

max time kernel
105s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
G2026.exe
Size 2.7MB
Sample250911-ryv1bser21
SHA256 2e6129b0aa7aed4e1161b9e09d14a2f5637cfd426e97fce1e95b0bee7ac28826
MD5 b605539082a0c40d7b956535f2da04cd
SHA1 5065e8ec76446bafe23bf5b9019033a7ee93a1c3
SHA512 bdf04c58e226acf447c9c082acc9a552d7d21e244d8c89c09d69a9f8eace81edad07e266159f2401fc7fbbfb81042c8594a863409d68321e6153baea6fb3a396
SSDEEP 49152:MW9EPhDJpCaedHL4cDX7qdl5zDkVdN3hmXccxlTpwRl2KJimWpzvVt:MW9EJ9pQdHXXmsNqTFc9WPt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

repeter defense_evasion discovery stealc spyware stealer themida trojan

Malware Config

Extracted

Family

stealc

Botnet

Repeter

http://178.16.54.175

Attributes

url_path
/e9762ff07e084dbb.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	G2026.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0yD7TkbM5xyc.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	2732	G2026.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	G2026.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	G2026.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0yD7TkbM5xyc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0yD7TkbM5xyc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\Control Panel\International\Geo\Nation	G2026.exe

Executes dropped EXE 2 IoCs

pid	Process
2076	0yD7TkbM5xyc.exe
2540	FadgttnyWhDt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000400000-0x0000000000A65000-memory.dmp	themida
behavioral1/memory/2732-2-0x0000000000400000-0x0000000000A65000-memory.dmp	themida
behavioral1/memory/2732-1-0x0000000000400000-0x0000000000A65000-memory.dmp	themida
behavioral1/memory/2732-3-0x0000000000400000-0x0000000000A65000-memory.dmp	themida
behavioral1/files/0x00070000000240fd-34.dat	themida
behavioral1/memory/2732-44-0x0000000000400000-0x0000000000A65000-memory.dmp	themida
behavioral1/memory/2076-46-0x0000000140000000-0x0000000140801000-memory.dmp	themida
behavioral1/memory/2076-45-0x0000000140000000-0x0000000140801000-memory.dmp	themida
behavioral1/memory/2076-49-0x0000000140000000-0x0000000140801000-memory.dmp	themida
behavioral1/memory/2732-68-0x0000000000400000-0x0000000000A65000-memory.dmp	themida
behavioral1/memory/2076-74-0x0000000140000000-0x0000000140801000-memory.dmp	themida
behavioral1/memory/2076-75-0x0000000140000000-0x0000000140801000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	G2026.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0yD7TkbM5xyc.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x0007000000024101-53.dat	ConfuserEx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2732	G2026.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G2026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	G2026.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	G2026.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2152	timeout.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2732	G2026.exe
2732	G2026.exe
2732	G2026.exe
2732	G2026.exe
2076	0yD7TkbM5xyc.exe
2076	0yD7TkbM5xyc.exe
2540	FadgttnyWhDt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	FadgttnyWhDt.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1504	2732	G2026.exe	84
PID 2732 wrote to memory of 1504	2732	G2026.exe	84
PID 2732 wrote to memory of 1504	2732	G2026.exe	84
PID 2732 wrote to memory of 2076	2732	G2026.exe	89
PID 2732 wrote to memory of 2076	2732	G2026.exe	89
PID 2732 wrote to memory of 2540	2732	G2026.exe	92
PID 2732 wrote to memory of 2540	2732	G2026.exe	92
PID 2732 wrote to memory of 1936	2732	G2026.exe	93
PID 2732 wrote to memory of 1936	2732	G2026.exe	93
PID 2732 wrote to memory of 1936	2732	G2026.exe	93
PID 1936 wrote to memory of 2152	1936	cmd.exe	96
PID 1936 wrote to memory of 2152	1936	cmd.exe	96
PID 1936 wrote to memory of 2152	1936	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\G2026.exe
"C:\Users\Admin\AppData\Local\Temp\G2026.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1504
- C:\Users\Admin\Documents\0yD7TkbM5xyc.exe
  "C:\Users\Admin\Documents\0yD7TkbM5xyc.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Users\Admin\Documents\FadgttnyWhDt.exe
  "C:\Users\Admin\Documents\FadgttnyWhDt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\G2026.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2152

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

709391CD-557E-7119-C205-E691EABDCE89.txt

Path C:\ProgramData\709391CD-557E-7119-C205-E691EABDCE89.txt
Size 64B
SHA256 59eb34ca9011a337b7e60d83b90708561b950727e1c00a8dc4baaf18ae46ede9
MD5 ffae63415218b7a44df29ae5266b36bf
SHA1 dac83ad88977bbce769aa143bbcd1c46a423127e
SHA512 5054f8e833432702776a1763fece2b398006f2238561478ac7f700ea342d2781be311dd92da7e33433bc198c1e4c1aeb6588daad950c84bb5065f9a2b7147c13
MD5 SHA1 SHA512

Submit Download

0yD7TkbM5xyc.exe

Path C:\Users\Admin\Documents\0yD7TkbM5xyc.exe
Size 7.8MB
SHA256 5349c0922ceed7d01cfb5ab850ce85561c7fce4f757c3f45cafc715c83dc0bfe
MD5 54e398d9ee0d9b42605488b98ed55aa6
SHA1 9ad5eb88521283ff220a4b6dc95d78c10a24247c
SHA512 1bdcf25f6105ae97a278caa2a34a6e70552c1b87fa99fb94e5037fec160f13112985f4bd2bde019e36c8d4b68ddf5d382557cf0315027e114e38470ba9e48f95
SSDEEP 98304:lK0PMFa29W9scsApkG7oY0gZL4X7IWWf8nMDy92hFwzq2JIuEBv1L+i67uCB:lzHkAzkGMrWUX76tDxhuO2Cna1ie
MD5 SHA1 SHA512 SSDEEP

Submit Download

FadgttnyWhDt.exe

Path C:\Users\Admin\Documents\FadgttnyWhDt.exe
Size 275KB
SHA256 f6a389551b5b6420c1fdb66e5a45a4bf4117354c9a2335f44e04592cb236f17e
MD5 e460c84d0637be900baf2bd667e713b9
SHA1 1dfc283b8fa0c8cf181cc4ca276068f9a63a4424
SHA512 9f1982ff5603a9aee72ef62684c9c2e997c438080ea0d8a98a6dbda5f91a79e66eef779f466d672e40fbae902c3158350f8bcd71374415466a8113a6904145d4
SSDEEP 6144:Rz0AnZTZK3FFxaYImszM+U6bVF6CoqaYPCIhnUhaZt6qDY8GANkBcjNIrSFYBnMQ:Rz0AnZ0FFxaYBszM+UAF6CoqaYPCIhnM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2076-45-0x0000000140000000-0x0000000140801000-memory.dmp

Download

memory/2076-49-0x0000000140000000-0x0000000140801000-memory.dmp

Download

memory/2076-75-0x0000000140000000-0x0000000140801000-memory.dmp

Download

memory/2076-74-0x0000000140000000-0x0000000140801000-memory.dmp

Download

memory/2076-46-0x0000000140000000-0x0000000140801000-memory.dmp

Download

memory/2540-67-0x0000000000810000-0x000000000085C000-memory.dmp

Download

memory/2732-2-0x0000000000400000-0x0000000000A65000-memory.dmp

Download

memory/2732-3-0x0000000000400000-0x0000000000A65000-memory.dmp

Download

memory/2732-61-0x0000000003800000-0x0000000003AC9000-memory.dmp

Download

memory/2732-63-0x0000000003C40000-0x0000000003D6A000-memory.dmp

Download

memory/2732-62-0x0000000003BA0000-0x0000000003C3B000-memory.dmp

Download

memory/2732-60-0x0000000003740000-0x00000000037FE000-memory.dmp

Download

memory/2732-68-0x0000000000400000-0x0000000000A65000-memory.dmp

Download

memory/2732-0-0x0000000000400000-0x0000000000A65000-memory.dmp

Download

memory/2732-44-0x0000000000400000-0x0000000000A65000-memory.dmp

Download

memory/2732-1-0x0000000000400000-0x0000000000A65000-memory.dmp

Download