stealc | 284e20e568416dc0d28e06c327ef161cac60d2d04aa6af6cf895dfd9869c9b23

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/01/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.3MB
Sample260131-eepyragw5g
SHA256 284e20e568416dc0d28e06c327ef161cac60d2d04aa6af6cf895dfd9869c9b23
MD5 60fed38c829e9d3fe73fb6847f9fd74d
SHA1 66c48219bc12ad0ca8135730f7cdb5aa64be49ff
SHA512 2b138e27ff442f587684a2922c92f2d8416e12b8c428b175285d29d6839601bf198980a58123fa0b37aa8fc59af47a640f81b38017707cdd95db304f389b19b2
SSDEEP 49152:izK6w3XVKX35qNBDwpVmHKnB7f8pupgzSNE3WiDUd+/w5EjuGjJK1OAdlupgzSNB:+w3XVpwmqxUy6
TLSH
T11C465A32B89545A2D67FE2349460739172317B9413313BE36F98166A0D7ABCC273FB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sigma discovery stealc spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

sigma

http://104.238.177.164

Attributes

url_path
/03ec61a401e346be.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	file.exe
1280	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 5220	1280	file.exe	79
PID 1280 wrote to memory of 5220	1280	file.exe	79
PID 1280 wrote to memory of 4268	1280	file.exe	82
PID 1280 wrote to memory of 4268	1280	file.exe	82

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2FDA9C10-6F5F-D0C4-1BD8-F74CF3200F54.txt

Path C:\ProgramData\2FDA9C10-6F5F-D0C4-1BD8-F74CF3200F54.txt
Size 64B
SHA256 3718370a24e4a1be94745db9615f78d68cb6afa7873d2dcbf76a852161d1be2b
MD5 c1fdf15da6dc86b40f2cbf9fd109d1a1
SHA1 04340240aca003d9a04d76c1ee999aa951989849
SHA512 e681b752718a46dfd446b6397c81af20097f2d703f1829ed37d4716d59e3a0d57eeda45cdfc1c73cbe6325351efc20182212bf14d9b9ca3beff3f38e3e977d96
TLSH
T119A0220C8C000CC0E0022A880BB0803EAAE2B2C0830A0FEE0000FA8A2003B3080C0208
MD5 SHA1 SHA512 TLSH

Submit Download

2FDA9C10-6F5F-D0C4-1BD8-F74CF3200F54.txt

Path C:\ProgramData\2FDA9C10-6F5F-D0C4-1BD8-F74CF3200F54.txt
Size 64B
SHA256 49fa06c323fa45103b4130743fd930cd79b0c07ed8bb5c4a039f799b0596ef0c
MD5 714b42b5ceb6a15fa029f46f213ae33f
SHA1 13aebd63a5580f9e94c5d4b3010ae1104948f97d
SHA512 78e83ef7f2c9d19b19e39d8596745dd2107e8a10e8803586202c05c33ddc8020af7a4867f64200904c7ef1ca779caf3685cd999d377f921c67aeb641f7a8851d
TLSH
T13EA0220000C02000B0000B208C088B20C00BC03B00C8200C8320800A0083C08220380E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1280-5-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-1-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-11-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-9-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-7-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-6-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-0-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-3-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-4-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-12-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-2-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-8-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-13-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-16-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-10-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-33-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1280-34-0x0000000140000000-0x00000001400CC000-memory.dmp

Download