stealc | 5cd5b457dec50b2fbca33e0cd340035ac272b47d120e85d6cd5ea7afaf503694

Resubmissions

11/04/2026, 02:20

260411-csmz7se15n10

11/04/2026, 02:16

260411-cqgqeae12l10

30/09/2025, 01:55

250930-cb4xds1ky710

30/09/2025, 00:01

250930-aa4twszjs310

Analysis

max time kernel
33s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
30/09/2025, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f34b5X.exe
Size 2.3MB
Sample250930-aa4twszjs3
SHA256 2dd15d74151531c7156a20297429cd371a603b458326d7972b2a95fed0e37ad4
MD5 17bd4081b31d476755b7768cd4d732a3
SHA1 92f40cea85051da8032040ceb6a0a44c81efeb7e
SHA512 cb391645f09e1889aed76f1512f8ea50edd7a27161277db04c9edc7dac941257aa1b4cd9ed90ac9c33ba30ea308711c6d7b2283b7c8064b076d934613a785ac2
SSDEEP 49152:387Ccat21HcKVhXze73RyQMHjiFp2+TlfxMQnTcoyW8dRX34aZ:6bZBzqsjiFp2+TVxM2Tt94RX3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tr1pernn defense_evasion discovery stealc spyware stealer themida trojan

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

http://178.16.54.175

Attributes

url_path
/e9762ff07e084dbb.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	wJMuS4c8aXiO.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	440	2f34b5X.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2f34b5X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2f34b5X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wJMuS4c8aXiO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wJMuS4c8aXiO.exe

Executes dropped EXE 2 IoCs

pid	Process
3332	wJMuS4c8aXiO.exe
5592	GAIbgbgwXxe9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000800000002587d-38.dat	themida
behavioral4/memory/3332-40-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral4/memory/3332-41-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral4/memory/3332-42-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral4/memory/3332-44-0x0000000140000000-0x0000000140808000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wJMuS4c8aXiO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2f34b5X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2f34b5X.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4872	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
440	2f34b5X.exe
440	2f34b5X.exe
3332	wJMuS4c8aXiO.exe
3332	wJMuS4c8aXiO.exe
5592	GAIbgbgwXxe9.exe
5592	GAIbgbgwXxe9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5592	GAIbgbgwXxe9.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4420	440	2f34b5X.exe	78
PID 440 wrote to memory of 4420	440	2f34b5X.exe	78
PID 440 wrote to memory of 4420	440	2f34b5X.exe	78
PID 440 wrote to memory of 3332	440	2f34b5X.exe	80
PID 440 wrote to memory of 3332	440	2f34b5X.exe	80
PID 440 wrote to memory of 5592	440	2f34b5X.exe	82
PID 440 wrote to memory of 5592	440	2f34b5X.exe	82
PID 440 wrote to memory of 3972	440	2f34b5X.exe	83
PID 440 wrote to memory of 3972	440	2f34b5X.exe	83
PID 3972 wrote to memory of 4872	3972	cmd.exe	85
PID 3972 wrote to memory of 4872	3972	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2f34b5X.exe
"C:\Users\Admin\AppData\Local\Temp\2f34b5X.exe"
1⤵
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4420
- C:\Users\Admin\Documents\wJMuS4c8aXiO.exe
  "C:\Users\Admin\Documents\wJMuS4c8aXiO.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Users\Admin\Documents\GAIbgbgwXxe9.exe
  "C:\Users\Admin\Documents\GAIbgbgwXxe9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2f34b5X.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4872

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7CF6129D-4E6E-F369-32D5-D6E15A8DBED9.txt

Path C:\ProgramData\7CF6129D-4E6E-F369-32D5-D6E15A8DBED9.txt
Size 64B
SHA256 a3896b1c83be3160027e4e8321db4453032b8e2e350c602c15a4aec2c6e8e32c
MD5 916a5e37530e48dd45d6f239a967c6da
SHA1 a97edd26944d8bcad3c1aff884765f63f8489f44
SHA512 09fb2adcd0f6f807305cb66e5b9038da470937008dc01df01719647a8b443ec88b7eadeb7d0a81d2eb35131538ee248d71d0fef5575855d6e53c3f30514b88c2
MD5 SHA1 SHA512

Submit Download

GAIbgbgwXxe9.exe

Path C:\Users\Admin\Documents\GAIbgbgwXxe9.exe
Size 3.7MB
SHA256 7a92b08fc5734f7cf8a50d33ce44ef92e4c0b4c60f1d21ab1732c7f8c55872ba
MD5 3c23d75909e56d6eacacc7147b7cf86d
SHA1 b22ea783bba32e77569282ce912950ef457fb93d
SHA512 6108f82bf3bdecffedbbd8b510429b2d19f1addb48099476d5fbb2b23f7a2187901e53ec1cd2b155b3909a2e444df377f9f8c8f44ad96ecbdd41089133ca7ec3
SSDEEP 98304:rn5pPmByJTy4zxAsWJRa8hGQ4aP7VWzTKI5bBoNihyQF5Lgn:r59mIJe4zxAsWzJRRVWRRphyQFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wJMuS4c8aXiO.exe

Path C:\Users\Admin\Documents\wJMuS4c8aXiO.exe
Size 7.8MB
SHA256 683312e40c3193f7402387ea6383b9df545bc25bd5d7dfeef74856268af0de99
MD5 40768124bf4e23f2c4e932d57c4a9d49
SHA1 bd4ee975bfa43a618e1546afa1114f73484a5cd2
SHA512 4c176be2b7a19420893d86694da8dff94d6d1c21a0ba01251462e54b502c0fc6062250a34a905879afa8dab9bd2ddd3efd16b501a22d158fb227d564a290ea8a
SSDEEP 196608:pscBq+oNnxbTINxwmbczQWVBOaaxOzKdZmwQgG:p8RlTINxwmbcsWO/O7wQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-0-0x00007FF60CA50000-0x00007FF60D08C000-memory.dmp

Download

memory/440-17-0x00007FF60CA50000-0x00007FF60D08C000-memory.dmp

Download

memory/440-25-0x00007FF60CA50000-0x00007FF60D08C000-memory.dmp

Download

memory/440-55-0x00007FF60CA50000-0x00007FF60D08C000-memory.dmp

Download

memory/3332-40-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/3332-41-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/3332-42-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/3332-44-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/5592-57-0x0000000140000000-0x0000000140B9D000-memory.dmp

Download