stealc | cc79b42806929b4fbe7c19c03f56f12ce16b4f2140060bd218e5418199668a99

Analysis

max time kernel
149s
max time network
87s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7c1d92be9fe96bdcee6e42c409e8d125_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 595KB
Sample260908-st7c8stbmc
SHA256 cc79b42806929b4fbe7c19c03f56f12ce16b4f2140060bd218e5418199668a99
MD5 7c1d92be9fe96bdcee6e42c409e8d125
SHA1 de4c944b86615e6bbf74dd3b0b86c1ebeff09f6e
SHA512 3d1f7b3605d0b1ecc2446b94d8bbb7b080c66c65ecbfd2af7c41035ad717f4e6512977ae9ca04c2a039dce33cb7a5555ffd018c45e691a2f933cbc23e5c38f66
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF3:8MpASIcWYx2U6hAJQnQ
TLSH
T131D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stealc urelas stealer trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4348-22-0x0000000000400000-0x000000000046E000-memory.dmp	family_stealc_v3

Executes dropped EXE 3 IoCs

pid	Process
3284	miemp.exe
3028	idkaro.exe
2796	quxiu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4084	cmd.exe
3432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_7c1d92be9fe96bdcee6e42c409e8d125_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miemp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idkaro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quxiu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe
2796	quxiu.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3284	4348	2026-09-08_7c1d92be9fe96bdcee6e42c409e8d125_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 4348 wrote to memory of 4084	4348	2026-09-08_7c1d92be9fe96bdcee6e42c409e8d125_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 3284 wrote to memory of 3028	3284	miemp.exe	92
PID 3028 wrote to memory of 2796	3028	idkaro.exe	93
PID 3028 wrote to memory of 3432	3028	idkaro.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7c1d92be9fe96bdcee6e42c409e8d125_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7c1d92be9fe96bdcee6e42c409e8d125_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\miemp.exe
  "C:\Users\Admin\AppData\Local\Temp\miemp.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\AppData\Local\Temp\idkaro.exe
    "C:\Users\Admin\AppData\Local\Temp\idkaro.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\quxiu.exe
      "C:\Users\Admin\AppData\Local\Temp\quxiu.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 764d53bdafb005a3ab3a073e1b9f2ac304d36747cd2e92bfcec124b9c02f88b9
MD5 1bc571307e13ffdb487be0f957c9f187
SHA1 fc41da0c80efa86b6b2ebd6a3df30383f051e675
SHA512 3afe36b0814e909bb56fdf8a8944ea4282c077a3025bee469fd9bde7d8fb583ac50976662bed4179a45c2cc66c775d49ae5065b21babf023311f6b5706f8df4b
TLSH
T1C8E09201417FD96A401CC01F41ADA69E92649E587FC637B07620C65DA2D98AFF6A2202
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 5a720aa9da3db08ad687b11a28029571037dbc0330817168235c0335e153ccc5
MD5 b747a64d8d62a3a45843afb764aded8c
SHA1 3a783be5e720b6b3e755c045cf7881ee317b9e20
SHA512 930ef72c3376317c641cdd0e63c5eeeee8bafe2723fa04d7a4b50662a82f162ea9aa479986cad22444a8d941ab345319765c9b90d077a30ea36d9728e629bace
TLSH
T189D0C71149D6D75F4458916F06B5A18DC0795C5C7F8B3B159721C44C22C182DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 75dd6ad57f63069eddb6d1eb1a7f1fc4e2820aa802aa5f2374a00f764fa4cba7
MD5 d5b39595667a53d5aee107b73ae71b35
SHA1 8843be225760ca9ea0f66cf156157e332004549b
SHA512 5640dcf9df4014b9acca291361af6365aa5f87ee903b2514c669464510493b4f40631acfd56c44e2e2579d38d2e11136ab700ab2451555f331cc9df0c60d3758
TLSH
T167F04CD11191B0593612A523E2E4179457A31D882D47ED44414576B44D35DAC84943D6
MD5 SHA1 SHA512 TLSH

Submit Download

idkaro.exe

Path C:\Users\Admin\AppData\Local\Temp\idkaro.exe
Size 595KB
SHA256 a30b7a2a375bc681261e38170715460c6690092f5519b421211ae5ad65226230
MD5 62bb6f04a14318459fd2e40744c56be3
SHA1 d96dd805e7411da894250c91c0e238b5189a3701
SHA512 8d335218dad4de36fbb174cc3ee46ded0ddebe60309f17f3244acee60f1b275f2a975998add4cd2ce85c42b5e5c1fc8c888254ccda0784f8d1b8518f797b7007
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFm:8MpASIcWYx2U6hAJQnh
TLSH
T102D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miemp.exe

Path C:\Users\Admin\AppData\Local\Temp\miemp.exe
Size 595KB
SHA256 f42c919489fa4601035d8a0d7e81da187713696133ac13c9673b0d37740fc970
MD5 b4d063a54197794c0b10de19f9831864
SHA1 9e5c34d1e4a60e75dab6986cd2450e063274b4fc
SHA512 80100b47e0f448670cf0ea9636544da481632299f6c11e58611cc7c175c1c5104cc32444a966458326e9c18875f1746d5f97ddaa199d354d4244958786cd2f10
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFN:8MpASIcWYx2U6hAJQn6
TLSH
T1ADD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quxiu.exe

Path C:\Users\Admin\AppData\Local\Temp\quxiu.exe
Size 223KB
SHA256 d60d5788318c5596601dacc714759e44ea130d099dc3328234075360d51d7739
MD5 3db36b48149a53124aba39c3c23c0a17
SHA1 5a998c25bd8253aebc561bab811420056d801580
SHA512 e5787406b4cdeb90041dde156e7ea98a3df909b2c4a8fe204d6498d1f1be43299e5f7b19874c9d95c77235dda01f6780a150bff404ad36bc257031cdc4ddb8d9
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3d:unFhSIkAyDgjtS/FZz
TLSH
T1EE24E042AA018888F34C4B316A17FAE449998D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2796-55-0x0000000000A50000-0x0000000000AF0000-memory.dmp

Download

memory/2796-45-0x0000000000A50000-0x0000000000AF0000-memory.dmp

Download

memory/2796-59-0x0000000000A50000-0x0000000000AF0000-memory.dmp

Download

memory/2796-58-0x0000000000A50000-0x0000000000AF0000-memory.dmp

Download

memory/2796-57-0x0000000000A50000-0x0000000000AF0000-memory.dmp

Download

memory/2796-56-0x0000000000A50000-0x0000000000AF0000-memory.dmp

Download

memory/3028-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3028-53-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3028-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3284-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3284-32-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4348-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4348-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4348-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download