stealc | ea7ac4dfa4526283857708d7cce336d3e8decc5779393a1105c3760835394fb6

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/03/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xea7ac4dfa4526283857708d7cce336d3e8decc5779393a1105c3760835394fb6.exe
Size 239KB
Sample260329-e6bv7sd19x
SHA256 ea7ac4dfa4526283857708d7cce336d3e8decc5779393a1105c3760835394fb6
MD5 3d38114652b01bc70fb587ea4ebe0449
SHA1 12f139426c87702e195423c5758253b08501ebd3
SHA512 18d3a589a046d486d307d05a52476e3a2b56179137e6672e069df4d31141cc718d6499877cde02de5649a9bf30d870e464fd96711b14c75646c0ec2dca3c5919
SSDEEP 3072:tJl+TFj5qDao8KaxfE54HnnGSail+bOX8bdZz+FHJKaNEHEmE7EQEYERVER1JE2:tJE5j5Ka2aOanGSabY7FpKa7JB
TLSH
T19F345C30E54204ADE19206FD69AE2F6BDC947E310324D0D363D25B8D2AE91F6997C73B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://37.1.213.84

Attributes

url_path
/e6e1bcda8702fc37.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xea7ac4dfa4526283857708d7cce336d3e8decc5779393a1105c3760835394fb6.exe

C:\Users\Admin\AppData\Local\Temp\xea7ac4dfa4526283857708d7cce336d3e8decc5779393a1105c3760835394fb6.exe
"C:\Users\Admin\AppData\Local\Temp\xea7ac4dfa4526283857708d7cce336d3e8decc5779393a1105c3760835394fb6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-0-0x0000000000D40000-0x0000000000F94000-memory.dmp

Download

memory/4712-2-0x0000000000D40000-0x0000000000F94000-memory.dmp