stealc | bad80b145550725bee88caa50d095c8fd8cf50ecc8d7d2bf532ac862a5d1d402

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/02/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe
Size 6.0MB
Sample260205-bmfs9scz8d
SHA256 bad80b145550725bee88caa50d095c8fd8cf50ecc8d7d2bf532ac862a5d1d402
MD5 c4d24e19ade97cbaa572a32e4c90abf4
SHA1 9793876737fccdc492f52dbbc0dea30e65236cbe
SHA512 10b5f06b543d5626ea4fbc62528f3e90b3578ef4dfd9b91d359a708f1e97663e2006171b2ca50b9fbd3a90eecadc7f537313a66a0bd2610202a545f9c0a9b3fe
SSDEEP 49152:7yxTOqc4zOGJ9l3IraB5wyoN+3zHCpj/bKtPtOr/TVz:oJJXQa4y/mpj/0Oz
TLSH
T18256D081807E0760C270F03E5623356F17BB3FE64689D2EBE8E8DD439C5B858E959AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

f111 stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

F111

http://198.251.89.171

Attributes

url_path
/e86b90f3097e4b27.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Executes dropped EXE 1 IoCs

pid	Process
4168	temp_mem_240665062.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2464	xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe
2464	xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4168	2464	xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe	80

C:\Users\Admin\AppData\Local\Temp\xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe
"C:\Users\Admin\AppData\Local\Temp\xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe"
1⤵
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\temp_mem_240665062.exe
  "temp_mem_240665062.exe"
  2⤵
  - Executes dropped EXE
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

temp_mem_240665062.exe

Path C:\Users\Admin\AppData\Local\Temp\temp_mem_240665062.exe
Size 735KB
SHA256 7b5888e312d4eb5a084b25325966a4d0903d7ec37b6d45a7473f82a6ff27ad63
MD5 924c3220b92cc10b68bada69caebcecc
SHA1 e305664e9a10344b090b8c04ce8f0c4756ce58b2
SHA512 01d249c414ee3c2471ce4bb6597f6d6ba067bb59508918055594cd29ac43d464e01f51c0a25c8925344c17d30f3a3afb8173bd1930723496a7d534fcbb064fe6
SSDEEP 12288:KU8VHX4ZPBuvzkOkW7UE+YTRqwJ4ijv3YZtF15kjHKA:QVH6BuvbkW7xXVVmib3UA
TLSH
T13AF48D5AE7A502F9D0BBC178CE424553EBB2B8055770978F03E15AA61F372A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download