stealc | b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
25/01/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb.exe
Size 260KB
Sample260125-qddd4scv5e
SHA256 b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb
MD5 d1cae4fe0df94e28b92841d7b18fae61
SHA1 4fcad5cf70b5d185689ed1c3dc67283c98eeae0c
SHA512 5d55c057d073909e9bd67e84e75139205749a0213de035133ba8ac10ec63d4c5725da07e4977d2d6f4d5a9249bbd3ea2c77d78c1aeec725a3c0aee370fdea5e8
SSDEEP 6144:DM9oGWv+sHThJ9wNri1qefzxk1urbomLjBGV3AMSb:sWv+yqozxkgnost
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

el stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

http://45.156.87.65

Attributes

url_path
/7b80bf859c454103.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 1928	868	dllhost.exe	78

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
868	dllhost.exe
868	dllhost.exe
3008	sihost.exe
3008	sihost.exe
3008	sihost.exe
3008	sihost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 868	2468	b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb.exe	77
PID 868 wrote to memory of 1928	868	dllhost.exe	78
PID 868 wrote to memory of 1928	868	dllhost.exe	78
PID 868 wrote to memory of 2504	868	dllhost.exe	79
PID 868 wrote to memory of 2504	868	dllhost.exe	79
PID 868 wrote to memory of 3008	868	dllhost.exe	49
PID 868 wrote to memory of 3008	868	dllhost.exe	49

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3008

C:\Users\Admin\AppData\Local\Temp\b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb.exe
"C:\Users\Admin\AppData\Local\Temp\b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    3⤵
    PID:1928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

369[1].bin

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LWAI35YL\369[1].bin
Size 817KB
SHA256 f9d5d29702307a947b871aadfe10318890fc6ac99eccb2212555a22a12043c1a
MD5 0b827778f8a4696e6684287515cd5e85
SHA1 f6fa304aca1ae3408480dbdd55523096afb30563
SHA512 b3b8cde2caeff52d84d4700567481b4ae36903c3a40c53dcf9d006df511109fbb86b3be8007559f953aac937e36c801da4ddad02f0fd25a5d10406acaecf1263
SSDEEP 24576:G7xfek+r8vdCngq7u0xUbJG0Ip7JIrNOq0c5QO:ieL6dCR7Be7Ip7JyOzcQO
TLSH
T1960523617FE7350D91735D10E143EDEB064163DA13A09EF42A92AB0F281BAC2B2DD677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DPjdd

Path C:\Users\Admin\AppData\Local\Temp\DPjdd
Size 64KB
SHA256 9d09788bb3ea0fc847c2c6e34156973d84c70460cc037b999b2219d6d7fc91db
MD5 853e0e960094ecbca8209603bd291ab7
SHA1 c523a283c41fab1e12fb014d2806fabccc2b4dcf
SHA512 a5098098f4896dea056e04a2e9cebaadb5b502824eb04db85e1f15ed3d41f0040ffbde18046ec6642c9a16e2b25b5ca2bc74333fe21967a35b04ad497ccb7b9a
SSDEEP 1536:eZYnz4fckUahDV/nGCA5UhDDc9/CgdxKczkHWXkZ326mW5Lzcz:eZizU1lnG75Yc9/CgdxKcRXP6B0
TLSH
T156530298E6FF55B56C44F3AE72C7657C2FC50900A62895E6352FA82A44463FF834BC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NnnLBN

Path C:\Users\Admin\AppData\Local\Temp\NnnLBN
Size 913KB
SHA256 b0b0de5102e07fe43a7c71bd044cbfd491ff411825c58ccdc945089cd9e443ea
MD5 3737607f234c2ff3b5451ade145b3bbb
SHA1 6f95ea61d2c4dc96150f5f7aa2e69300c055a004
SHA512 9cc42c31f6b6dfddc26ce9b794a9b7b6001acc84a0db82f447279e836952ac4a3fa7db682f5d13698e5944c7e180581d58b55c2cd5716dbe1be2353e1aaa1c53
SSDEEP 24576:QglkmWobPhmoWA+3VqOB5XcJTUv7ouG24O:VmmLUoWA+FrBo4v7IS
TLSH
T14115331C26FA4B555FE47E2A8328CC14B442D78AC220E890D87FE59B4B3E40FD9CB5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaw9Bytr4W.png

Path C:\Users\Admin\AppData\Local\jaw9Bytr4W.png
Size 64B
SHA256 37cdf3d63d8a06450ca0d441fbe587db4d757f18639aa3bb4f5135acb8f53adc
MD5 56553171a858937f0406907edd6a2447
SHA1 37ca236e8b4308b8a8b7aabdb3a39c83979d6d1e
SHA512 d08719c574d2a69cf8155b864431f84a6267c62c929a986735358198c688eff09e3d1019fabcd37f0e10e7bb8cc200d51c71b8a683e815c22016b3ccd758607b
TLSH
T124A00238EA9EE903DA76040AB66869849A8BDB330965060385F4D1DE61465554C581E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1928-15-0x00007FF65D160000-0x00007FF65D22C000-memory.dmp

Download

memory/1928-19-0x00007FF65D160000-0x00007FF65D22C000-memory.dmp

Download

memory/2468-1-0x00007FF7A1350000-0x00007FF7A1399000-memory.dmp

Download

memory/2468-0-0x0000028BA3400000-0x0000028BA3401000-memory.dmp

Download

memory/3008-30-0x0000015AF1170000-0x0000015AF1181000-memory.dmp

Download

memory/3008-76-0x0000015AF1170000-0x0000015AF1181000-memory.dmp

Download