stealc | 1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb

Analysis

max time kernel
102s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250610-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250610-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
22/09/2025, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chaos Solution.exe
Size 6.4MB
Sample250922-w75ckssry2
SHA256 1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb
MD5 6c0b293ef533afcffb3d34bc47f1971c
SHA1 ad342f1b7439453c4ec459e00d33d813dcaa8014
SHA512 9358daf7225b6038670f8220fb54be1524738151570b7897360cd3350ec2ecaf8604fd6957e95ace5d2c6d6269ecfa4b0da0120022736e34e359935f3d7a7dbb
SSDEEP 98304:MeRtUtk4ou2cdZdxsToXuikHehKxb/v9eH+GMC5iMbl7MZdzwy5YQY+L+1qp3VTQ:tvf8QoT10Z/v2lEMxab5DOl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

for4dexine defense_evasion discovery stealc spyware stealer themida trojan

Malware Config

Extracted

Family

stealc

Botnet

for4dexine

http://178.16.54.175

Attributes

url_path
/e9762ff07e084dbb.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WzCf5XiCd2x2.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	4680	Chaos Solution.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WzCf5XiCd2x2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WzCf5XiCd2x2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3947991112-772902407-1479079202-1000\Control Panel\International\Geo\Nation	Chaos Solution.exe

Executes dropped EXE 2 IoCs

pid	Process
604	WzCf5XiCd2x2.exe
4360	VrDsOGEkTuan.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000028127-9.dat	themida
behavioral2/memory/604-30-0x0000000140000000-0x00000001407D6000-memory.dmp	themida
behavioral2/memory/604-29-0x0000000140000000-0x00000001407D6000-memory.dmp	themida
behavioral2/memory/604-49-0x0000000140000000-0x00000001407D6000-memory.dmp	themida
behavioral2/memory/604-50-0x0000000140000000-0x00000001407D6000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WzCf5XiCd2x2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chaos Solution.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chaos Solution.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Chaos Solution.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
912	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4680	Chaos Solution.exe
4680	Chaos Solution.exe
604	WzCf5XiCd2x2.exe
604	WzCf5XiCd2x2.exe
4360	VrDsOGEkTuan.exe
4360	VrDsOGEkTuan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	VrDsOGEkTuan.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4420	4680	Chaos Solution.exe	82
PID 4680 wrote to memory of 4420	4680	Chaos Solution.exe	82
PID 4680 wrote to memory of 4420	4680	Chaos Solution.exe	82
PID 4680 wrote to memory of 604	4680	Chaos Solution.exe	90
PID 4680 wrote to memory of 604	4680	Chaos Solution.exe	90
PID 4680 wrote to memory of 4360	4680	Chaos Solution.exe	92
PID 4680 wrote to memory of 4360	4680	Chaos Solution.exe	92
PID 4680 wrote to memory of 2612	4680	Chaos Solution.exe	93
PID 4680 wrote to memory of 2612	4680	Chaos Solution.exe	93
PID 4680 wrote to memory of 2612	4680	Chaos Solution.exe	93
PID 2612 wrote to memory of 912	2612	cmd.exe	95
PID 2612 wrote to memory of 912	2612	cmd.exe	95
PID 2612 wrote to memory of 912	2612	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Chaos Solution.exe
"C:\Users\Admin\AppData\Local\Temp\Chaos Solution.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4420
- C:\Users\Admin\Documents\WzCf5XiCd2x2.exe
  "C:\Users\Admin\Documents\WzCf5XiCd2x2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:604
- C:\Users\Admin\Documents\VrDsOGEkTuan.exe
  "C:\Users\Admin\Documents\VrDsOGEkTuan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Chaos Solution.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:912

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B49A847-FABC-04C3-105F-C41BD8F74CF3.txt

Path C:\ProgramData\7B49A847-FABC-04C3-105F-C41BD8F74CF3.txt
Size 64B
SHA256 8e3d36e2459b7bf05eb2a98ab1c57daf1a8a16a2d166f750546058dbcbf409c2
MD5 30a09b340ea24c116bef6d5efd08e05a
SHA1 b29b7321a9f66e543d5d459d65f31bb933cb7aeb
SHA512 582709113c78a5bdd6f7a196a5d3f92091ea58a1bb07cb3eb23e07560fef0a6fc5c761cfc01314373ea98848f3d4bddcc8b4089b4d4a5cc3f832c157b2a938ee
MD5 SHA1 SHA512

Submit Download

VrDsOGEkTuan.exe

Path C:\Users\Admin\Documents\VrDsOGEkTuan.exe
Size 7.6MB
SHA256 c320f3f143eb47dcb61e886cc4c01305075621f6f266a2d360fb33186d02e9a9
MD5 085cc72bc2c209850836005bb6e4c96a
SHA1 d22e7e8c62f91fb367eb60b753fa4ad532b17ce5
SHA512 42311a546453737643261e9ed69f2bb55db23d4c43ec393998f2f4595525038b13072675cab80a6d797d9ab5717cecdbc8b32896ccdd5cf293d560eb973bb5b6
SSDEEP 49152:2LcWDiwt6Ads7cd5roiwiS5xo5eOqDh2VDXb6ddfVRYZu9YGOvCiIq4kFU2j+oQf:2TdYcd5roiwiS5cE2daNUC9u5/0hQPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

WzCf5XiCd2x2.exe

Path C:\Users\Admin\Documents\WzCf5XiCd2x2.exe
Size 7.6MB
SHA256 e92537a1d279f3ca1a3c5a276b59af380e02b3d2f046daf293f9cb7288d6d83b
MD5 6feaf5104510848323dae285b9f68b1e
SHA1 1a6f3ccab87e557754884f977a24b462c9078edd
SHA512 ae059e66f0e208fe0cde546f45550e105df7427f925d88824a651ffc5a069427b32dbec2e6ad435cffd947e4122dee4fd60bd846259e754c9fd263850314f24c
SSDEEP 196608:byoljnaVPBowYCU2hJc2XQbalJ/oo1urX+zK:W6aVzYCUh2XQbYJQ8JzK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/604-50-0x0000000140000000-0x00000001407D6000-memory.dmp

Download

memory/604-49-0x0000000140000000-0x00000001407D6000-memory.dmp

Download

memory/604-30-0x0000000140000000-0x00000001407D6000-memory.dmp

Download

memory/604-29-0x0000000140000000-0x00000001407D6000-memory.dmp

Download

memory/4680-23-0x00000000040A0000-0x0000000004396000-memory.dmp

Download

memory/4680-26-0x0000000004510000-0x0000000004633000-memory.dmp

Download

memory/4680-25-0x0000000004470000-0x0000000004510000-memory.dmp

Download

memory/4680-22-0x0000000003FE0000-0x000000000409D000-memory.dmp

Download

memory/4680-27-0x0000000004640000-0x0000000004667000-memory.dmp

Download

memory/4680-28-0x0000000004670000-0x0000000004700000-memory.dmp

Download

memory/4680-0-0x0000000000AB0000-0x000000000149C000-memory.dmp

Download