Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20251016-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2025, 02:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 2.0MB
  • Sample251121-c8y3eahv6g
  • SHA256 9e383eb4eb99b76f00ab9012ed640da0445779d9a69feee95f0044d099e4353a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
teststealcpersistencestealer

Malware Config

Extracted

Family

  • stealc

Botnet

  • test

C2

  • http://91.212.150.45

Attributes
  • url_path

    /08c9da84c91a4542.php

rc4.plain

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Windows\SYSTEM32\runexehelper.exe
      runexehelper.exe
      2⤵
        PID:804
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /v /c Set ESKahpKI=cmd & !ESKahpKI! < Weekly.eml
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\system32\cmd.exe
          cmd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Windows\system32\findstr.exe
            findstr /V "planets" Andrea
            4⤵
              PID:3224
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\79319\Registered.com
              Registered.com V
              4⤵
              • Deletes itself
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3848
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\79319\Registered.com
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\79319\Registered.com
                5⤵
                • Executes dropped EXE
                PID:1664

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Registered.com
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\79319\Registered.com
            • Size 1.1MB
            • SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            V
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\79319\V
            • Size 1.3MB
            • SHA256 f5ff03f38b54d9ded156d2f3f514bab8f9baeb364c65416e2a723e4490f67a3f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Andrea
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Andrea
            • Size 2KB
            • SHA256 018094a630201cece53d77a9b59613f200d88d88e6fa31fba759327d787ff65a
            • MD5 SHA1 SHA512
            Submit Download

            Blackberry
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Blackberry
            • Size 100KB
            • SHA256 daa14646ea3661f00660b33521c64f94de1874968eb20a339b85f0f69e7a31d3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Buzz.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Buzz.eml
            • Size 226KB
            • SHA256 161b16b293d1150b3047677bef323eb1fe5e08508984291ec238787a2dbe4d92
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            California
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\California
            • Size 111KB
            • SHA256 e3800cb3a0d34bda1060bed642a8d5d781b0d51473b5d433179c573f55be8765
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Decision
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Decision
            • Size 84KB
            • SHA256 51d7ba66a5e557dcd86fe9f58bb87fbfddbc6a4057987ea9a66397a86fa203ee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Designated.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Designated.eml
            • Size 248KB
            • SHA256 f1be5dda680676c8c0c3deaed5dff0effa49458ac34940685d60f5b5e282106b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Dock.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dock.eml
            • Size 173KB
            • SHA256 d593fa24933473611d6b6ddf0e586c09095b23552c66442c6be34d42aebc598c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Govt.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Govt.eml
            • Size 247KB
            • SHA256 539890a6b894b42d73511ddede06bd9af8ebc13e1dc36c7d299db5efd9a80478
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Liable
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Liable
            • Size 75KB
            • SHA256 cd1d7acaaa72aa47c2d047effef9f1e2d091f1ce362171ecb4c1432e340f0a9f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Mexican
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mexican
            • Size 118KB
            • SHA256 1a08ec35e61f087d709f694c136c817c09d97b1c8d153778c8ada722eddcd53c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Mins
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mins
            • Size 52KB
            • SHA256 467ebaef0fb55c5327edc01f9810d3af845675181d9fa7cb03af4ede7c72b53f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Positions
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Positions
            • Size 65KB
            • SHA256 423295c717c108976b7f3521a30d110354bf1025fe4c98e09707218c8111b468
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Print
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Print
            • Size 104KB
            • SHA256 4c8088fecf586a0b806f86cb1c7c38b0c87ef481d3c502ee265a0e41eaf5d02c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Readily
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Readily
            • Size 121KB
            • SHA256 6aef6148dc11dded068341001dbc6e4191730b50ef0ccd85882490c4d1483400
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Reed
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Reed
            • Size 79KB
            • SHA256 f7fb57bee9614aa9203b8dd579acb6f6fabaf5e985a3f2b847e8e6fd8e56b306
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Respected.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Respected.eml
            • Size 245KB
            • SHA256 63b96a8a8bebda62a508f1824c0167d0aff4fd97b4cff9545d1fbf2e1b50c052
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Statements
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Statements
            • Size 104KB
            • SHA256 b5a50b062c0e57949b94441fcd9ef7b7e4190dd274dafba3d779b1244c423394
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Surplus
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Surplus
            • Size 66KB
            • SHA256 36f89772419ef85cbbf8dada4670e19e6edf73c2ffbd53109b6d8f4a7a80a002
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Threesome.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Threesome.eml
            • Size 227KB
            • SHA256 a438a9c4ee6a91a3342cb1985e6c9b6ad82a5177c692aa5abe4cbaf6cb2788b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Weekly.eml
            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Weekly.eml
            • Size 5KB
            • SHA256 ae6c00406b2de48f0fc0add5cfb14a141c322dab68d57defa54ea440e3bdefc5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1664-78-0x000002D612DF0000-0x000002D612EBE000-memory.dmp
            Download

            memory/1664-79-0x000002D612DF0000-0x000002D612EBE000-memory.dmp
            Download

            memory/1664-81-0x000002D612DF0000-0x000002D612EBE000-memory.dmp
            Download

            memory/1664-82-0x000002D612DF0000-0x000002D612EBE000-memory.dmp
            Download

            memory/3848-77-0x0000028614FE0000-0x0000028614FE1000-memory.dmp
            Download