Overview

overview

7

Static

static

3

Stealth-Do...er.exe

windows10-2004-x64

5

Stealth-Do...er.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

Stealth Do...er.exe

windows10-2004-x64

7

Stealth Do...er.exe

windows11-21h2-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-21h2-x64

1

locales/af.ps1

windows10-2004-x64

3

locales/af.ps1

windows11-21h2-x64

3

locales/uk.ps1

windows10-2004-x64

3

locales/uk.ps1

windows11-21h2-x64

3

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-21h2-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/04/2026, 03:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Stealth Downloader.exe
  • Size 154.6MB
  • Sample260416-d2xrfaez2j
  • SHA256 7240d0ba24bd2cf8026a8ae972252ca079f68271a184e3e280754a50f54fe2e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
      "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1704,i,3434428135172467846,3491735482027352789,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:688
      • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
        "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --mojo-platform-channel-handle=2156 --field-trial-handle=1704,i,3434428135172467846,3491735482027352789,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5472
      • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
        "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2232 --field-trial-handle=1704,i,3434428135172467846,3491735482027352789,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        PID:1640
      • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
        "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 --field-trial-handle=1704,i,3434428135172467846,3491735482027352789,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5908
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\Stealth-Setup-1776310445168.exe""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\Users\Admin\AppData\Local\Temp\Stealth-Setup-1776310445168.exe
          "C:\Users\Admin\AppData\Local\Temp\Stealth-Setup-1776310445168.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2984

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StdUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsn4846.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsn4846.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UAC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsn4846.tmp\UAC.dll
          • Size 14KB
          • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Roaming\Stealth-Downloader\Network\Network Persistent State
          • Size 489B
          • SHA256 70ae0616fec6dfee97f7bc0970f7c849bb5925830145ff31906c63e6c4349203
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State~RFe593ce0.TMP
          • Path C:\Users\Admin\AppData\Roaming\Stealth-Downloader\Network\Network Persistent State~RFe593ce0.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2984-104-0x00000000007B0000-0x000000000082E000-memory.dmp
          Download

          memory/5908-84-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-85-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-83-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-82-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-81-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-80-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-79-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-74-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-75-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download

          memory/5908-73-0x0000018691AD0000-0x0000018691AD1000-memory.dmp
          Download