Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/03/2026, 07:00
General
- Target bf0940e105f105a2f6e4e75c6ea56ded68702fe6ada477a1ae6db20f7c101da5.exe
- Size 1.7MB
- Sample260317-hs2fgset2l
- SHA256 bf0940e105f105a2f6e4e75c6ea56ded68702fe6ada477a1ae6db20f7c101da5
Malware Config
Extracted
-
stealc
-
3
-
http://45.131.214.233
-
url_path
/c14fbedecd404e0eba6c.php
Signatures
- Detects Stealc stealer Version 2 14 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf0940e105f105a2f6e4e75c6ea56ded68702fe6ada477a1ae6db20f7c101da5.exe"C:\Users\Admin\AppData\Local\Temp\bf0940e105f105a2f6e4e75c6ea56ded68702fe6ada477a1ae6db20f7c101da5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Screenshot album\gkMXfGxopSK0x6SpVBcjeLFc.exe"C:\Users\Admin\Documents\Screenshot album\gkMXfGxopSK0x6SpVBcjeLFc.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gkMXfGxopSK0x6SpVBcjeLFc.exe
memory/1968-0-0x0000000140000000-0x000000014004E000-memory.dmp
memory/1968-28-0x0000000140000000-0x000000014004E000-memory.dmp
memory/3196-19-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-17-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-22-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-21-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-20-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-26-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-18-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-23-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-15-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-14-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-16-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-27-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-25-0x0000000140000000-0x00000001400D3000-memory.dmp
memory/3196-24-0x0000000140000000-0x00000001400D3000-memory.dmp