stealc | 6af02f9f08e5d6e9318ed302e4d74618148f7c600af1b394e05812b18b8ca040

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10.6MB
Sample260703-3ppmqsdv4j
SHA256 6af02f9f08e5d6e9318ed302e4d74618148f7c600af1b394e05812b18b8ca040
MD5 6c05ab37c2665353719dc535df55d6c4
SHA1 2801386033834bede5f00d5442192cdfd6fe31ce
SHA512 ec0779f33d4069a65cbef0663749e0e5bd7aac1964052d9e2ed4a414d407460e01e67d0b462cc1a235f7f7f84bb3c553fdbd09e1178189b5f5025ff16a6f0f37
SSDEEP 49152:vrP7Fu9N/CRE6ceYo+HTbBsoyE2anHcRhfLQCVXcBRT4kWc/msgy654KUjESSsD+:vrBERnHc/DQjkv2NB8eg2dS2aZIF+
TLSH
T1F5B68D03F9D540E9C05AD2758BAA8222BA71BC494B3177DF1A9077352FB6BE05F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

v3 discovery stealc spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

http://64.224.17.118/b98b577ad87f42dbbf91.php

Attributes

url_path
/b98b577ad87f42dbbf91.php

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Executes dropped EXE 1 IoCs

pid	Process
5688	vKZJS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	file.exe
2724	file.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1588	2724	file.exe	89
PID 2724 wrote to memory of 1588	2724	file.exe	89
PID 2724 wrote to memory of 5452	2724	file.exe	92
PID 2724 wrote to memory of 5452	2724	file.exe	92
PID 2724 wrote to memory of 5348	2724	file.exe	95
PID 2724 wrote to memory of 5348	2724	file.exe	95
PID 2724 wrote to memory of 3756	2724	file.exe	98
PID 2724 wrote to memory of 3756	2724	file.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\vKZJS.exe
  "C:\Users\Admin\AppData\Local\Temp\vKZJS.exe"
  2⤵
  - Executes dropped EXE
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A247A22-7025-EB46-B14A-DD2EA9F21596.txt

Path C:\ProgramData\8A247A22-7025-EB46-B14A-DD2EA9F21596.txt
Size 64B
SHA256 53210fe6277608651a24b1b63380d8e9ef04dce6d8bbdfb263f0dd9c2ebfbc74
MD5 fe298e103eece6132256f3363420e225
SHA1 5166baaa74f0b19798e5c301ad29608ef62873d3
SHA512 ff97cb8e9a8161391f55ab268bbd011076add705775511f5e1ebc0246bc4447f8b307d8b58912a4564b7a94319c4e5c08d367afb84b88ff82205d61a588ed65c
TLSH
T1E2A022C003CC28808023800020C82CBB380032CA820CFA002CA20B0E30202200A03802
MD5 SHA1 SHA512 TLSH

Submit Download

vKZJS.exe

Path C:\Users\Admin\AppData\Local\Temp\vKZJS.exe
Size 4.0MB
SHA256 aa1f1d2a87f998a0499feafa2f985eacff4313e9537a5076de6c498d07a08492
MD5 194c91fc4f942a97d13827de4fcb1991
SHA1 bfceaf9aa323b1962a6243e9c1336c9e05540416
SHA512 cd2dddf01bcf089c54690d66b907d4fdd69a3865a041316a6bd420e5cf28abe2de5a0ef43ac9a0c91250e65d309b5d2211e69ede03f47a8c62dace057b712354
SSDEEP 49152:ehfLQCVXcBRT4kWc/msgy654KUjESSsD8odAjOBDIkzukPq2FMJu5u/2dBZTBCpI:qDQjkv2NB8eg2dS2aZu
TLSH
T157168C13F2DA51D8C019C179874B9232EA72BC455B3566DF0A9077162FBAFE06B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2724-12-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-10-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-16-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-14-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-13-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-11-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-18-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-17-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-7-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-8-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-20-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-15-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-9-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-21-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-19-0x0000000140000000-0x00000001400D4000-memory.dmp

Download

memory/2724-24-0x0000000140000000-0x00000001400D4000-memory.dmp

Download