stealc | 7c55845fd1b8e87ce32a94635a9c004bbcb4e3dd530677ab93067683487071af

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_d1951b23b8fb12f5b9d7f853ae561932_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 47.9MB
Sample260821-l2e6dsxeqa
SHA256 7c55845fd1b8e87ce32a94635a9c004bbcb4e3dd530677ab93067683487071af
MD5 d1951b23b8fb12f5b9d7f853ae561932
SHA1 be80621b8b6eee71b2887a2d0cb8683582a1e87e
SHA512 a1b2aeb6387000b7341a508f0c711b6eeb3da7fe54c23c3c1de2be5e9cc30e099ed4d51d7c522202bf169ca438c700ba43faa0b367950a66e5f3d5bd4a4e5e7c
SSDEEP 393216:476L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yf+nVQx4urYsANulL7NR:40LoCOn+2+s4urYDNulLBiuF
TLSH
T1D7B7BD0372E60095E8B7D2388AA75503D773B8635731DADF326D06152FBBAD49A7B320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://176.65.142.161

Attributes

url_path
/f698bbaeef359c28.php

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Executes dropped EXE 1 IoCs

pid	Process
2812	fantastic.exe

Loads dropped DLL 5 IoCs

pid	Process
2812	fantastic.exe
2812	fantastic.exe
2812	fantastic.exe
2812	fantastic.exe
2812	fantastic.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 5632	2812	fantastic.exe	92

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2812	4940	2026-08-21_d1951b23b8fb12f5b9d7f853ae561932_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	90
PID 2812 wrote to memory of 2908	2812	fantastic.exe	91
PID 2812 wrote to memory of 5632	2812	fantastic.exe	92
PID 2812 wrote to memory of 5632	2812	fantastic.exe	92
PID 2812 wrote to memory of 5632	2812	fantastic.exe	92
PID 2812 wrote to memory of 5632	2812	fantastic.exe	92
PID 2812 wrote to memory of 5632	2812	fantastic.exe	92
PID 2812 wrote to memory of 5632	2812	fantastic.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-21_d1951b23b8fb12f5b9d7f853ae561932_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_d1951b23b8fb12f5b9d7f853ae561932_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\fantastic.exe
  C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\fantastic.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:2908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:5632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

atom.dll

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\atom.dll
Size 2.4MB
SHA256 7740f128f7ebae69a962977ff911369e82f3cc6146eedb5ba75e8cf3bf0196f2
MD5 86f8e3bec0f282e9333f959cbddf07ca
SHA1 357d22eb85df1fc47d6ae343b7e001b0a80f953b
SHA512 19a7d1a6cf768b33dcef15627a2ac1b80cf2ed3b7d4738bb0eaf8ff2a81eed3fe0c6b4c38739ff3184e3083b3be189f3a3be26b60040d911b66b4487dc8bf6ec
SSDEEP 24576:RAWrJkRNGAXDqaFXnsUb91Uta6ujansqbHf1H2nTeaA48mS+Wrf9TTJ2z7trX0Rd:R5JkbHzqaFB6K1NJER3Xs31/wd9aWO6
TLSH
T153C5BE11E39800B8D9BBD734CA968333D670B9969735964B0A98C7052F33EE15B3F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

encoding-conversion.dll

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\encoding-conversion.dll
Size 23KB
SHA256 685cce3972313dbba027be3d5770cf0c360d165f9d8335529e5bebecbd6dfe27
MD5 e3c35dbbe9c3792b5e5d82f17ce288cf
SHA1 7c205e7d955f7e67809e212dac1d305b75113cf0
SHA512 c154e457dccaaf4e6a58c37892cf820f85a632a1dd08ed71a189b36614a66764a19642331b4ac3c91c61e9a01b229e4b8f082f78c03e805775b524cb2267eb03
SSDEEP 384:VMe9zcdgoGFDJoloh6nYPLpFzDGG5mDFzDGd8JN77hhdxC:VwOoGFSW0EBDGG5mDBDG63hXxC
TLSH
T1DDB24B859F2418A2E997CAB0F0E6D61FAE30B78167A1D2DF427CC1611FC1BC232B915D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fantastic.exe

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\fantastic.exe
Size 561KB
SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
MD5 457142f0e24c04ac21fc367182c9e5a4
SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
TLSH
T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp290.dll

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\msvcp290.dll
Size 6.9MB
SHA256 37da4a7a149ae4077bf05a93c49393c8c0c19361a49110c6df34f3133451e1ed
MD5 4f7a134027a716ca2c297cd160a6a9af
SHA1 a3bece6aefe0e7662a59ff6ec9e02633091cffe3
SHA512 2d7b97c990a960a35b3218028ddc985d7f85a0c9e27381458ea8f408047b0935582c62cf6aa3036b4f231bbf791bf56433cc4e2846827ddb092461ced6dc5a5d
SSDEEP 49152:40Nb9XiDXgwcLuB2OYJk4H0U6z8AohqL7gFmVhJLQ+EnUJnIQ0PgQrhtU:flXek+EnanIQ0frh
TLSH
T12A766A06EF985A66D16AC638C93BCB32D3F1FD640231831B2015E38E6DB77D94B5B219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nasrallah_x86.dll

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\nasrallah_x86.dll
Size 240KB
SHA256 4cb6a8bba58150b47f4a77f64f8dad422ac8950ad648f7ec04679c73a44c00c8
MD5 21175b8d3220e951ef7da7c7f775d9a3
SHA1 44ecb110dee3e1d1e560d8bebc1007d55cae2b33
SHA512 8ebe9bd87f612e542d45a5f1355de7eef94686b343453cf0d7ffb08ea5db441ad5676143e55f35ef3d1c8e1a673afc6a7370aee2083f0143208dea71f542bef5
SSDEEP 3072:FgQEuGqhZlU9vp1rY6aSVsHqzMQ00487o/BKDpWWUlGby0jKmRCHeP3KqX+n:6uVpk1rYgJ00VM4NWWB+0jKcCot+
TLSH
T13B340A25EF40443EED12D17CDABA63D6B12669A86312D8D333C8251E4DF40E32D7E66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root-service-provider.dll

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\root-service-provider.dll
Size 850KB
SHA256 f9651a6d5f970604ad5918734f3a41c06274cd0d392cffbad60fafb9def90452
MD5 c68f1ff358d9687f07a24f2740704726
SHA1 ae20ab4677a7e282b2bf96d7e6d644ee071e47de
SHA512 261b164f38808817cd192ffd3dac24920fb98fb0f69de6641726bfe43b95233cf46750f7f5579ffbece95d4a8894d3b17e1089ca55ac627a0b03bb1bf1907451
SSDEEP 12288:F0nkkxXfxAXg2GokubGCgqYWYDZxjRO5s1K6MlkfI:F0nJrAXg2BNblxNYDZxjR9s
TLSH
T18D05B61BBEB951E1C0BAC0399493653EF8B174A29B3157C75291971F1F23BE4AA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime210.dll

Path C:\Users\Admin\AppData\Local\Temp\6b50278f8f9968c817c9e68f632eab34\vcruntime210.dll
Size 3KB
SHA256 dee641bf2185ce254d7869fcfb795d1f92307b652b7d47fab5ec684c2c35491e
MD5 825fe3b4b435ab98b9bdb69f2b251c86
SHA1 000a289bcefeee4ceef62235904ae962d60c0cd1
SHA512 e9d1add753247256b37dcfc61c9591037c99c91dd5194513a4cef3d87be106c3eff0515b4f3ac006658a854b865a25c40fdd7e5aeb474c485c81a0cdeec44f58
TLSH
T17C615CB42A4742EFD082A58077E824F56E44FB123008A64E1E55163BC566B27C669251
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-25-0x00007FFF00240000-0x00007FFF00525000-memory.dmp

Download

memory/5632-22-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5632-26-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5632-24-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5632-27-0x0000000000400000-0x0000000000650000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads