stealc | c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe
Size 1.5MB
Sample260910-mkhevsar9x
SHA256 c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337
MD5 6077f8c9e2cc10cef3c97b8b2674ed1c
SHA1 e3cea10ce2358b58e044baca9f457652bfbdb97a
SHA512 4e14287b6858a221876ac36a0a194c2225abb8fbe3bf1282da862c3a697cc4bf270d21e345de25a688446aa6c2feecf8e140cc32b75ffb8c1f9f523a5b2b77c4
SSDEEP 24576:vo6ijP7VlkA/cxkm/OtKpDXWJt7HCkcKrqv9q1lGsk+E3wtvPT+kks1Cjy:voFjP7VlpIkdsuRHC1Kre9WlvQ3wtnSH
TLSH
T13A75238887935B2ED8FAABF55671F13163B61C9C6462E18E1EEE3EDF3A167100400797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution stealc persistence stealer

Malware Config

Extracted

Family

stealc

https://update-microsoft-data.services

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4624-15-0x0000000140000000-0x00000001400D7000-memory.dmp	family_stealc_v3

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5932	powershell.exe
4376	powershell.exe
4152	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3980	UbAkodqWAhZ.exe
5872	UbAkodqWAhZ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\UbAkodqWAhZ = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\aa5clznxadu.ps1\""	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6012 set thread context of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 3980 set thread context of 5872	3980	UbAkodqWAhZ.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe
5932	powershell.exe
5932	powershell.exe
4152	powershell.exe
4152	powershell.exe
3980	UbAkodqWAhZ.exe
4376	powershell.exe
4376	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeIncreaseQuotaPrivilege	5932	powershell.exe
Token: SeSecurityPrivilege	5932	powershell.exe
Token: SeTakeOwnershipPrivilege	5932	powershell.exe
Token: SeLoadDriverPrivilege	5932	powershell.exe
Token: SeSystemProfilePrivilege	5932	powershell.exe
Token: SeSystemtimePrivilege	5932	powershell.exe
Token: SeProfSingleProcessPrivilege	5932	powershell.exe
Token: SeIncBasePriorityPrivilege	5932	powershell.exe
Token: SeCreatePagefilePrivilege	5932	powershell.exe
Token: SeBackupPrivilege	5932	powershell.exe
Token: SeRestorePrivilege	5932	powershell.exe
Token: SeShutdownPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeSystemEnvironmentPrivilege	5932	powershell.exe
Token: SeRemoteShutdownPrivilege	5932	powershell.exe
Token: SeUndockPrivilege	5932	powershell.exe
Token: SeManageVolumePrivilege	5932	powershell.exe
Token: 33	5932	powershell.exe
Token: 34	5932	powershell.exe
Token: 35	5932	powershell.exe
Token: 36	5932	powershell.exe
Token: SeDebugPrivilege	3980	UbAkodqWAhZ.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeIncreaseQuotaPrivilege	4376	powershell.exe
Token: SeSecurityPrivilege	4376	powershell.exe
Token: SeTakeOwnershipPrivilege	4376	powershell.exe
Token: SeLoadDriverPrivilege	4376	powershell.exe
Token: SeSystemProfilePrivilege	4376	powershell.exe
Token: SeSystemtimePrivilege	4376	powershell.exe
Token: SeProfSingleProcessPrivilege	4376	powershell.exe
Token: SeIncBasePriorityPrivilege	4376	powershell.exe
Token: SeCreatePagefilePrivilege	4376	powershell.exe
Token: SeBackupPrivilege	4376	powershell.exe
Token: SeRestorePrivilege	4376	powershell.exe
Token: SeShutdownPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeSystemEnvironmentPrivilege	4376	powershell.exe
Token: SeRemoteShutdownPrivilege	4376	powershell.exe
Token: SeUndockPrivilege	4376	powershell.exe
Token: SeManageVolumePrivilege	4376	powershell.exe
Token: 33	4376	powershell.exe
Token: 34	4376	powershell.exe
Token: 35	4376	powershell.exe
Token: 36	4376	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 5932	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	88
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 6012 wrote to memory of 4624	6012	c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe	90
PID 4152 wrote to memory of 3980	4152	powershell.exe	94
PID 3980 wrote to memory of 4376	3980	UbAkodqWAhZ.exe	96
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98
PID 3980 wrote to memory of 5872	3980	UbAkodqWAhZ.exe	98

C:\Users\Admin\AppData\Local\Temp\c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe
"C:\Users\Admin\AppData\Local\Temp\c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe
  C:\Users\Admin\AppData\Local\Temp\c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337.exe
  2⤵
  PID:4624

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\aa5clznxadu.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Roaming\UbAkodqWAhZ.exe
  "C:\Users\Admin\AppData\Roaming\UbAkodqWAhZ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UbAkodqWAhZ.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- - C:\Users\Admin\AppData\Roaming\UbAkodqWAhZ.exe
    C:\Users\Admin\AppData\Roaming\UbAkodqWAhZ.exe
    3⤵
    - Executes dropped EXE
    PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dk0readm.uua.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dk0readm.uua.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aa5clznxadu.ps1

Path C:\Users\Admin\AppData\Local\Temp\aa5clznxadu.ps1
Size 1KB
SHA256 e6f86bf764840f23aafe242c9464e2bdb358e0aaf91f358ba77052a7f7607522
MD5 f29b6ee4567a19bd1c11294ffba98956
SHA1 ed73c130cb911de999a8a9864c4703c9f5b8b201
SHA512 0929246784e7e40c0970945de568366a7273933bc70264aeccc631ac9944ba4aa6d9b90e6a8f82b8c9358088d8bc9f223bf325e87f6325e22e7c80339d6ba588
TLSH
T11911C1478E8457C5446447E0465334CE745DB0CF17AF118496EDB4EEB32BD23342ACE4
MD5 SHA1 SHA512 TLSH

Submit Download

UbAkodqWAhZ.exe

Path C:\Users\Admin\AppData\Roaming\UbAkodqWAhZ.exe
Size 1.5MB
SHA256 c36dcc736bf5def64a87906eff82b50758241bdca8afcb6a0cd6ff689ed3b337
MD5 6077f8c9e2cc10cef3c97b8b2674ed1c
SHA1 e3cea10ce2358b58e044baca9f457652bfbdb97a
SHA512 4e14287b6858a221876ac36a0a194c2225abb8fbe3bf1282da862c3a697cc4bf270d21e345de25a688446aa6c2feecf8e140cc32b75ffb8c1f9f523a5b2b77c4
SSDEEP 24576:vo6ijP7VlkA/cxkm/OtKpDXWJt7HCkcKrqv9q1lGsk+E3wtvPT+kks1Cjy:voFjP7VlpIkdsuRHC1Kre9WlvQ3wtnSH
TLSH
T13A75238887935B2ED8FAABF55671F13163B61C9C6462E18E1EEE3EDF3A167100400797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4376-52-0x0000020C385F0000-0x0000020C386A2000-memory.dmp

Download

memory/4624-15-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5932-32-0x000001912DE80000-0x000001912DE9E000-memory.dmp

Download

memory/5932-33-0x0000019146300000-0x00000191463B2000-memory.dmp

Download

memory/5932-44-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-41-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-37-0x000001912DE70000-0x000001912DE7A000-memory.dmp

Download

memory/5932-12-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-13-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-14-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-34-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-20-0x000001912DDF0000-0x000001912DE12000-memory.dmp

Download

memory/5932-17-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-16-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-23-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-22-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-29-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-24-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-25-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-26-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-27-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/5932-28-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-21-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-0-0x00007FFDBCE5F000-0x00007FFDBCE60000-memory.dmp

Download

memory/6012-7-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-6-0x0000024BF5050000-0x0000024BF505C000-memory.dmp

Download

memory/6012-5-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-10-0x0000024BFA440000-0x0000024BFA5A8000-memory.dmp

Download

memory/6012-4-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-3-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-9-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-2-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-8-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/6012-1-0x0000024BF4960000-0x0000024BF4AE0000-memory.dmp

Download