Overview

overview

7

Static

static

3

Stealth-Do...er.exe

windows10-2004-x64

5

Stealth-Do...er.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

Stealth Do...er.exe

windows10-2004-x64

7

Stealth Do...er.exe

windows11-21h2-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-21h2-x64

1

locales/af.ps1

windows10-2004-x64

3

locales/af.ps1

windows11-21h2-x64

3

locales/uk.ps1

windows10-2004-x64

3

locales/uk.ps1

windows11-21h2-x64

3

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-21h2-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 03:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Stealth Downloader.exe
  • Size 154.6MB
  • Sample260416-d2xrfaez2j
  • SHA256 7240d0ba24bd2cf8026a8ae972252ca079f68271a184e3e280754a50f54fe2e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
      "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1696,i,4819374904779273739,6282249734435206833,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:4700
      • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
        "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --mojo-platform-channel-handle=1980 --field-trial-handle=1696,i,4819374904779273739,6282249734435206833,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1192
      • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
        "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2208 --field-trial-handle=1696,i,4819374904779273739,6282249734435206833,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5052
      • C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe
        "C:\Users\Admin\AppData\Local\Temp\Stealth Downloader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Stealth-Downloader" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 --field-trial-handle=1696,i,4819374904779273739,6282249734435206833,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2128

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Roaming\Stealth-Downloader\Network\Network Persistent State
          • Size 489B
          • SHA256 36a03b684b3cbcb473d375e786f33cb0ab293d5c53f724cf49dd9fd039d9e56c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State~RFe5934d2.TMP
          • Path C:\Users\Admin\AppData\Roaming\Stealth-Downloader\Network\Network Persistent State~RFe5934d2.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2128-79-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-75-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-74-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-73-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-85-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-84-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-80-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-82-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-83-0x0000024309320000-0x0000024309321000-memory.dmp
          Download

          memory/2128-81-0x0000024309320000-0x0000024309321000-memory.dmp
          Download