Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 13:58
General
- Target Setup (2).exe
- Size 1.4MB
- Sample260723-q97mtsbc92
- SHA256 516253e18a40301f846afdf0f2f6ec98a22e48be04e937524df274ca34b7e70f
Malware Config
Extracted
-
stealc
-
RUN
-
http://196.251.107.163
Extracted
-
svcstealer
-
http://196.251.107.186/acovp/post.php
-
http://192.162.199.186/usovp/post.php
-
http://196.251.107.163/bioxp/post.php
-
build_id
Dropped
-
srv_delay
1
-
srv_retry
1
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Executes dropped EXE 9 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\axpjlzoj.exe"C:\Users\Admin\AppData\Local\Temp\axpjlzoj.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\jw0pbs45.exe"C:\Users\Admin\AppData\Local\Temp\jw0pbs45.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\idxncmst.exe"C:\Users\Admin\AppData\Local\Temp\idxncmst.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security Scanner"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security Scanner" /tr "C:\Users\Admin\AppData\Roaming\ortmy\bolmi.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CFFE.tmp.exeC:\Users\Admin\AppData\Local\Temp\CFFE.tmp.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v4⤵
-
-
-
-
C:\ProgramData\feaebadbcccaefdc.exe"C:\ProgramData\feaebadbcccaefdc.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jw0pbs45.exe"C:\Users\Admin\AppData\Local\Temp\jw0pbs45.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\ortmy\bolmi.exeC:\Users\Admin\AppData\Roaming\ortmy\bolmi.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v2⤵
-
-
C:\Users\Admin\AppData\Roaming\ortmy\bolmi.exe"C:\Users\Admin\AppData\Roaming\ortmy\bolmi.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
axpjlzoj.exe
idxncmst.exe
jw0pbs45.exe
memory/716-26-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-23-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-25-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-24-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-27-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-90-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-22-0x00007FF92551F000-0x00007FF925520000-memory.dmp
memory/716-34-0x00007FF9253C0000-0x00007FF925623000-memory.dmp
memory/716-36-0x00007FF923887000-0x00007FF923888000-memory.dmp
memory/1312-51-0x00007FF641390000-0x00007FF6413AE000-memory.dmp
memory/1312-58-0x00007FF641390000-0x00007FF6413AE000-memory.dmp
memory/1928-83-0x00007FF641390000-0x00007FF6413AE000-memory.dmp
memory/2320-53-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-65-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-127-0x0000000005EA0000-0x0000000005EE5000-memory.dmp
memory/2320-106-0x0000000005E50000-0x0000000005E95000-memory.dmp
memory/2320-37-0x0000000002530000-0x0000000002533000-memory.dmp
memory/2320-57-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-35-0x0000000002540000-0x0000000002547000-memory.dmp
memory/2320-102-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-32-0x0000000002540000-0x0000000002547000-memory.dmp
memory/2320-64-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2320-63-0x0000000003410000-0x0000000003411000-memory.dmp
memory/2320-100-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-71-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-70-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-68-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-67-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-66-0x0000000002560000-0x0000000002585000-memory.dmp
memory/2320-93-0x00000000068E0000-0x0000000006925000-memory.dmp
memory/2320-89-0x0000000003470000-0x0000000003471000-memory.dmp
memory/2320-85-0x0000000003430000-0x0000000003470000-memory.dmp
memory/2320-81-0x0000000003420000-0x0000000003421000-memory.dmp
memory/2320-86-0x0000000006090000-0x00000000060D5000-memory.dmp
memory/2336-77-0x00007FF66D030000-0x00007FF66D04E000-memory.dmp
memory/2336-76-0x00007FF66D030000-0x00007FF66D04E000-memory.dmp
memory/4336-44-0x0000018F8FCA0000-0x0000018F8FCA7000-memory.dmp
memory/4336-96-0x0000018F8FCA0000-0x0000018F8FCA7000-memory.dmp
memory/4336-38-0x0000018F8FCA0000-0x0000018F8FCA7000-memory.dmp
memory/4380-97-0x000001DD1CB20000-0x000001DD1CB27000-memory.dmp
memory/4380-45-0x000001DD1CB20000-0x000001DD1CB27000-memory.dmp
memory/4380-40-0x000001DD1CB20000-0x000001DD1CB27000-memory.dmp
memory/4396-2-0x0000000140000000-0x00000001400D5000-memory.dmp
memory/5036-46-0x00000251ADFE0000-0x00000251ADFE7000-memory.dmp
memory/5036-42-0x00000251ADFE0000-0x00000251ADFE7000-memory.dmp
memory/5036-98-0x00000251ADFE0000-0x00000251ADFE7000-memory.dmp