stealc | 5cd5b457dec50b2fbca33e0cd340035ac272b47d120e85d6cd5ea7afaf503694

Resubmissions

11/04/2026, 02:20

260411-csmz7se15n10

11/04/2026, 02:16

260411-cqgqeae12l10

30/09/2025, 01:55

250930-cb4xds1ky710

30/09/2025, 00:01

250930-aa4twszjs310

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2025, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f34b5X.exe
Size 2.3MB
Sample250930-aa4twszjs3
SHA256 2dd15d74151531c7156a20297429cd371a603b458326d7972b2a95fed0e37ad4
MD5 17bd4081b31d476755b7768cd4d732a3
SHA1 92f40cea85051da8032040ceb6a0a44c81efeb7e
SHA512 cb391645f09e1889aed76f1512f8ea50edd7a27161277db04c9edc7dac941257aa1b4cd9ed90ac9c33ba30ea308711c6d7b2283b7c8064b076d934613a785ac2
SSDEEP 49152:387Ccat21HcKVhXze73RyQMHjiFp2+TlfxMQnTcoyW8dRX34aZ:6bZBzqsjiFp2+TVxM2Tt94RX3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tr1pernn defense_evasion discovery stealc spyware stealer themida trojan

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

http://178.16.54.175

Attributes

url_path
/e9762ff07e084dbb.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	QTntjbYhYiXg.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	1236	2f34b5X.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	QTntjbYhYiXg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2f34b5X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2f34b5X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	QTntjbYhYiXg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	2f34b5X.exe

Executes dropped EXE 2 IoCs

pid	Process
3928	QTntjbYhYiXg.exe
5788	NV9CAOZUdH0d.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/files/0x0007000000024042-33.dat	themida
behavioral3/memory/3928-43-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral3/memory/3928-44-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral3/memory/3928-47-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral3/memory/3928-62-0x0000000140000000-0x0000000140808000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	QTntjbYhYiXg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2f34b5X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2f34b5X.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5024	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1236	2f34b5X.exe
1236	2f34b5X.exe
3928	QTntjbYhYiXg.exe
3928	QTntjbYhYiXg.exe
5788	NV9CAOZUdH0d.exe
5788	NV9CAOZUdH0d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5788	NV9CAOZUdH0d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4652	1236	2f34b5X.exe	83
PID 1236 wrote to memory of 4652	1236	2f34b5X.exe	83
PID 1236 wrote to memory of 4652	1236	2f34b5X.exe	83
PID 1236 wrote to memory of 3928	1236	2f34b5X.exe	92
PID 1236 wrote to memory of 3928	1236	2f34b5X.exe	92
PID 1236 wrote to memory of 5788	1236	2f34b5X.exe	94
PID 1236 wrote to memory of 5788	1236	2f34b5X.exe	94
PID 1236 wrote to memory of 5068	1236	2f34b5X.exe	95
PID 1236 wrote to memory of 5068	1236	2f34b5X.exe	95
PID 5068 wrote to memory of 5024	5068	cmd.exe	97
PID 5068 wrote to memory of 5024	5068	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2f34b5X.exe
"C:\Users\Admin\AppData\Local\Temp\2f34b5X.exe"
1⤵
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4652
- C:\Users\Admin\Documents\QTntjbYhYiXg.exe
  "C:\Users\Admin\Documents\QTntjbYhYiXg.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Users\Admin\Documents\NV9CAOZUdH0d.exe
  "C:\Users\Admin\Documents\NV9CAOZUdH0d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5788
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2f34b5X.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5024

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F8D2E5FC-E083-9950-1F04-DB18B78CB360.txt

Path C:\ProgramData\F8D2E5FC-E083-9950-1F04-DB18B78CB360.txt
Size 64B
SHA256 cf0aa5c545c2aac478a4547f10f53ceaa5c0cb4d9a2c486921c4d73e786f5874
MD5 05ac89cb867071c952943bf1c69ff072
SHA1 bb11d9e14b89c91d873baf32e9705e139683e8ab
SHA512 2330049b676c55fa2f1657ec2babf6dcc0b7a89f404c636a15a63e01b3819832c1d8cf8861deb75b6f2d5ced509dd9c75956a4b17e229c709a67a6cf46877808
MD5 SHA1 SHA512

Submit Download

NV9CAOZUdH0d.exe

Path C:\Users\Admin\Documents\NV9CAOZUdH0d.exe
Size 3.7MB
SHA256 7a92b08fc5734f7cf8a50d33ce44ef92e4c0b4c60f1d21ab1732c7f8c55872ba
MD5 3c23d75909e56d6eacacc7147b7cf86d
SHA1 b22ea783bba32e77569282ce912950ef457fb93d
SHA512 6108f82bf3bdecffedbbd8b510429b2d19f1addb48099476d5fbb2b23f7a2187901e53ec1cd2b155b3909a2e444df377f9f8c8f44ad96ecbdd41089133ca7ec3
SSDEEP 98304:rn5pPmByJTy4zxAsWJRa8hGQ4aP7VWzTKI5bBoNihyQF5Lgn:r59mIJe4zxAsWzJRRVWRRphyQFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

QTntjbYhYiXg.exe

Path C:\Users\Admin\Documents\QTntjbYhYiXg.exe
Size 7.8MB
SHA256 683312e40c3193f7402387ea6383b9df545bc25bd5d7dfeef74856268af0de99
MD5 40768124bf4e23f2c4e932d57c4a9d49
SHA1 bd4ee975bfa43a618e1546afa1114f73484a5cd2
SHA512 4c176be2b7a19420893d86694da8dff94d6d1c21a0ba01251462e54b502c0fc6062250a34a905879afa8dab9bd2ddd3efd16b501a22d158fb227d564a290ea8a
SSDEEP 196608:pscBq+oNnxbTINxwmbczQWVBOaaxOzKdZmwQgG:p8RlTINxwmbcsWO/O7wQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1236-0-0x00007FF678600000-0x00007FF678C3C000-memory.dmp

Download

memory/1236-27-0x00007FF678600000-0x00007FF678C3C000-memory.dmp

Download

memory/1236-28-0x00007FF678600000-0x00007FF678C3C000-memory.dmp

Download

memory/1236-56-0x00007FF678600000-0x00007FF678C3C000-memory.dmp

Download

memory/3928-43-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/3928-44-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/3928-47-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/3928-62-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/5788-57-0x0000000140000000-0x0000000140B9D000-memory.dmp

Download