stealc | 64fa7afa4d7f383a26b2d1c5c2490ea06d75ab77d71acea4ebd6b8063f11452f

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/02/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.2MB
Sample260201-yg58asew8a
SHA256 64fa7afa4d7f383a26b2d1c5c2490ea06d75ab77d71acea4ebd6b8063f11452f
MD5 3dba9880dab0a503daf6e294c64294d7
SHA1 6a3bdd531675de516ae355ad2d3f3d3354bfa1bf
SHA512 9a03e79b44b29d76abb654e47ab7883be199c3396ef813b891fcc506f0de18cf9b066d07a774d88a58f8870d255bfc9877ede4f131ea66387f10e48c604bf904
SSDEEP 49152:LA4skAPBoZH1SBoDF4eL4pc+O0acT6AaSw2RLjQJeHmlIZSNk:sOKGMo5mZraSrRU2R
TLSH
T15C463A52A895F9A9C6BFE1B4D0A02252763134D5C3313FE32ED915B6096AEC8273F31D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

qwfwrgf discovery stealc spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

qwfwrgf

http://158.94.210.74

Attributes

url_path
/4d4b240c75954580.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4292 set thread context of 2768	4292	file.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	explorer.exe
2768	explorer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2768	4292	file.exe	79
PID 4292 wrote to memory of 2768	4292	file.exe	79
PID 2768 wrote to memory of 1424	2768	explorer.exe	80
PID 2768 wrote to memory of 1424	2768	explorer.exe	80
PID 2768 wrote to memory of 4784	2768	explorer.exe	83
PID 2768 wrote to memory of 4784	2768	explorer.exe	83
PID 2768 wrote to memory of 672	2768	explorer.exe	85
PID 2768 wrote to memory of 672	2768	explorer.exe	85
PID 2768 wrote to memory of 3048	2768	explorer.exe	87
PID 2768 wrote to memory of 3048	2768	explorer.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C3D4CE32-3CD5-C6D6-E15A-8DBED902C526.txt

Path C:\ProgramData\C3D4CE32-3CD5-C6D6-E15A-8DBED902C526.txt
Size 64B
SHA256 75361bc8628f2dcd23501725042d78b3703889069ca78142ff8694dae723146c
MD5 bb0a2973c8dc5b515e736e0b9260c185
SHA1 66db4ccd66d85991f50873d70aabf10889a9f667
SHA512 cae85e358ed998d361f1705522d1c1ed421e8eba5d01d3a55f53b057fcf8a7c6828e9d7ad3d1c8154f20668898c853fd5b8630eab845f34cea43affe9a93d506
TLSH
T136A022C0B0800B2A28320F08E00B00080200C000003F8E02C83028800EF80088AB0008
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2768-2-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-10-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-14-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-15-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-13-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-11-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-0-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-9-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-8-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-7-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-16-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-3-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-5-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-12-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-6-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-4-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-1-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-19-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-26-0x0000000003630000-0x00000000036ED000-memory.dmp

Download

memory/2768-28-0x0000000003B90000-0x0000000003C2E000-memory.dmp

Download

memory/2768-29-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-27-0x00000000036F0000-0x0000000003A64000-memory.dmp

Download

memory/2768-50-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download

memory/2768-54-0x0000000000D00000-0x0000000000DA9000-memory.dmp

Download