stealc | 9a6872a650bffa7b42a4fb73ebb8d81dc8a60aeeccc71b23e0449612bd88e51c

Analysis

max time kernel
103s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
24/09/2025, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.6MB
Sample250924-emb2vs1wev
SHA256 9a6872a650bffa7b42a4fb73ebb8d81dc8a60aeeccc71b23e0449612bd88e51c
MD5 8336d73a7b3ddf572de7e044ff54830d
SHA1 e1597ba90a309932b19108dff49c0c228f6ac63d
SHA512 d886563a56ee8eb221a3b491cfed41bfb8daae9182efe2a9de441c1614938d8f90152f9fb24ca6fe3d755199ff409b42c3e4d8ef43b842f0d5009b893aea2c0f
SSDEEP 196608:90L8R/johVgscDmfTgnvqZ1yCUhNDRBewm886hZ2:90Lg/Qwmf0vG6B6mc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tr1pernn defense_evasion discovery stealc spyware stealer themida trojan

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

http://178.16.54.175

Attributes

url_path
/e9762ff07e084dbb.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0l77JO26rilH.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	5256	file.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0l77JO26rilH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0l77JO26rilH.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 2 IoCs

pid	Process
4020	0l77JO26rilH.exe
4492	8gCSH8lw34ln.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000024093-31.dat	themida
behavioral1/memory/4020-43-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral1/memory/4020-41-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral1/memory/4020-42-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral1/memory/4020-53-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral1/memory/4020-54-0x0000000140000000-0x0000000140808000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0l77JO26rilH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4784	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5256	file.exe
5256	file.exe
4020	0l77JO26rilH.exe
4020	0l77JO26rilH.exe
4492	8gCSH8lw34ln.exe
4492	8gCSH8lw34ln.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	8gCSH8lw34ln.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 4032	5256	file.exe	83
PID 5256 wrote to memory of 4032	5256	file.exe	83
PID 5256 wrote to memory of 4032	5256	file.exe	83
PID 5256 wrote to memory of 4020	5256	file.exe	90
PID 5256 wrote to memory of 4020	5256	file.exe	90
PID 5256 wrote to memory of 4492	5256	file.exe	92
PID 5256 wrote to memory of 4492	5256	file.exe	92
PID 5256 wrote to memory of 4608	5256	file.exe	93
PID 5256 wrote to memory of 4608	5256	file.exe	93
PID 4608 wrote to memory of 4784	4608	cmd.exe	95
PID 4608 wrote to memory of 4784	4608	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4032
- C:\Users\Admin\Documents\0l77JO26rilH.exe
  "C:\Users\Admin\Documents\0l77JO26rilH.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Users\Admin\Documents\8gCSH8lw34ln.exe
  "C:\Users\Admin\Documents\8gCSH8lw34ln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4784

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2E7A911F-8404-C2DB-18B7-8CB360CF940B.txt

Path C:\ProgramData\2E7A911F-8404-C2DB-18B7-8CB360CF940B.txt
Size 64B
SHA256 cf0aa5c545c2aac478a4547f10f53ceaa5c0cb4d9a2c486921c4d73e786f5874
MD5 05ac89cb867071c952943bf1c69ff072
SHA1 bb11d9e14b89c91d873baf32e9705e139683e8ab
SHA512 2330049b676c55fa2f1657ec2babf6dcc0b7a89f404c636a15a63e01b3819832c1d8cf8861deb75b6f2d5ced509dd9c75956a4b17e229c709a67a6cf46877808
MD5 SHA1 SHA512

Submit Download

0l77JO26rilH.exe

Path C:\Users\Admin\Documents\0l77JO26rilH.exe
Size 7.8MB
SHA256 8ae74420b8cf6cf72a3422e447f0d0a807b9b0888cbd86cc846f612a8ffe49af
MD5 f8ad3c25885c5c7472b88102ffa43051
SHA1 7338fd8003b7625678816dfd4944d9264e799aed
SHA512 fcb6910fe038d82fac370c1bcabe1a0fd5ace599bba9e57c702dc290049748a4c5dba331109b119570a4543cf98fba643d7733bc56c2a5c6e5e0bb60aaa2027e
SSDEEP 196608:7PB/2B/BKx1Z5DCztLQ2K0bh1PDxTtAL9k3NXry/AkX:7PBc/kT820bPPsL9CNIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

8gCSH8lw34ln.exe

Path C:\Users\Admin\Documents\8gCSH8lw34ln.exe
Size 7.6MB
SHA256 c320f3f143eb47dcb61e886cc4c01305075621f6f266a2d360fb33186d02e9a9
MD5 085cc72bc2c209850836005bb6e4c96a
SHA1 d22e7e8c62f91fb367eb60b753fa4ad532b17ce5
SHA512 42311a546453737643261e9ed69f2bb55db23d4c43ec393998f2f4595525038b13072675cab80a6d797d9ab5717cecdbc8b32896ccdd5cf293d560eb973bb5b6
SSDEEP 49152:2LcWDiwt6Ads7cd5roiwiS5xo5eOqDh2VDXb6ddfVRYZu9YGOvCiIq4kFU2j+oQf:2TdYcd5roiwiS5cE2daNUC9u5/0hQPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4020-43-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/4020-41-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/4020-42-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/4020-53-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/4020-54-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/5256-1-0x00007FF765160000-0x00007FF765F2D000-memory.dmp

Download