stealc | f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1

Analysis

max time kernel
149s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/02/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe
Size 1.2MB
Sample260219-xlc7msgz7h
SHA256 f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1
MD5 cb7d153e0b6288be03b05d92c9636b04
SHA1 1dc5beb369f0af15c1fbf792060ae782d5b7c14c
SHA512 e2a447811e35275e25c7907f1ddc0a9fa7a1c682f7fb562234603754350cf2fd0cec5ff4778e3d496f86be0c55f91c60856c20ec55ca3d8dcbfc87490f935fc0
SSDEEP 24576:igHo19TDgiST8sj8PCVLz0iCUIxLtvuwIXmjMRxG:igKkT8o0lWwqmn
TLSH
T1E545E035904262DAF1A680B35A455680F563B83747392FEF42F4E7751E0AEE80F3E716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

logsdillercloud stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

LogsDillerCloud

http://trainisshit.shop

Attributes

url_path
/19b574f278f94a33.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80
PID 3128 wrote to memory of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80
PID 3128 wrote to memory of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80
PID 3128 wrote to memory of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80
PID 3128 wrote to memory of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80
PID 3128 wrote to memory of 2476	3128	f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe	80

C:\Users\Admin\AppData\Local\Temp\f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe
"C:\Users\Admin\AppData\Local\Temp\f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-0-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

memory/2476-4-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

memory/2476-3-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

memory/2476-2-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

memory/2476-1-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads