stealc | 7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413.exe
Size 1.9MB
Sample260729-mkbbjsek3x
SHA256 7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413
MD5 40d291a45b171ed64df46347ff3aecd1
SHA1 5a444dc300e998eb0a4534935155f6a78e3517ca
SHA512 80b3f89c4f1296853f965d10ccb15df9b076f090764eb71f61c109202a2580ab9c77892158420cb55567cc7219a709f625837f82f752006317b0dffc19364fd9
SSDEEP 49152:k+0ZuCfEgroyt7NMujuLcUgBDkquzYUJKEf5cdpnMihG:k+0ZYgroU7juViDkdYelqdp5
TLSH
T1FB95330352D851E2E8785B75A8AB46479B7038B29F7C75DF7185E68E0E230E29337723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

test stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

test

http://43.228.157.66

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Executes dropped EXE 2 IoCs

pid	Process
816	AutoIt3.exe
5796	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 816 set thread context of 5796	816	AutoIt3.exe	90

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
816	AutoIt3.exe
816	AutoIt3.exe
816	AutoIt3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 816	5852	7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413.exe	89
PID 816 wrote to memory of 5796	816	AutoIt3.exe	90
PID 816 wrote to memory of 5796	816	AutoIt3.exe	90
PID 816 wrote to memory of 5796	816	AutoIt3.exe	90

C:\Users\Admin\AppData\Local\Temp\7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413.exe
"C:\Users\Admin\AppData\Local\Temp\7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Waters.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:5796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Waters.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Waters.a3x
Size 1.4MB
SHA256 d867b0fa84cf8c33f7972634846aa5d46da394d6bfdfcc433fad107e0ec6631d
MD5 ddd335a48fb5554c731604f9e3252c48
SHA1 12e1f37ce2cdc7eba6d9103dc98b96fa5d2620b4
SHA512 c46467e86aab9278812a2721e82544509be74f2d9bbc8a63915ff2f18e760a9ffba254f2097e122ced7d10a7df053f8eace13230b47d1ba04777e32e0d0deb51
SSDEEP 24576:2wFpg7vjT0XoxChhq9iDcgp2umOcgXUgFL7GNVvi6tNCPGAh7ufO+3Lj7yXeF+Yn:5TeX0XooM6HMumOdXUgB70dtAJGO+Ge3
TLSH
T159653337860AE8B40A892C96FE4C9E1EF1DC73B3B94E74D6ECD7DACD11654296303A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-7-0x00007FFFD2460000-0x00007FFFD26C3000-memory.dmp

Download

memory/816-8-0x000001F158220000-0x000001F158221000-memory.dmp

Download

memory/5796-10-0x000001F4A2A40000-0x000001F4A2B15000-memory.dmp

Download

memory/5796-11-0x000001F4A2A40000-0x000001F4A2B15000-memory.dmp

Download