Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file_e8219df7a9a21088.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target file_e8219df7a9a21088.exe
- Size 6.8MB
- Sample260910-pp216staka
- SHA256 adedb76b5b1859f620895bf12670ded2ced8ea0756757f144c59612172c2c1ca
- MD5 1b076ebb9d35f1258f588e881568c857
- SHA1 4a85d8611b45d01bbc968c52d7f9c64f09710391
- SHA512 7bdf5671fb52ce759c4a158e84ad164c033fbe99a68ee9dbf67c6006aca04bfafd063df92ce56b8f11b09b1f16cc0fdf7c56292a89fcd6727a0285646ce3de75
- SSDEEP 49152:pIB+UOi20Hdc11gLEUQa4gLbY68SLqUx6j4p1E1k1bQposR9:mgUOD0Hdc11gTQzgfYfqTr/TiposR9
- TLSH T1E3761801EBCB84F2D8562B30249B776F27399C090F7AD663EE543979BE733501D22689
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
stealc
C2
-
http://91.92.242.73
rc4.plain
Signatures
- Detects Stealc stealer Version 3 15 IoCs
resource yara_rule behavioral2/memory/4456-3-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-4-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-12-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-13-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-9-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-8-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-7-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-5-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-11-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-10-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-6-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-2-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-1-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-0-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 behavioral2/memory/4456-14-0x0000000000400000-0x00000000004B3000-memory.dmp family_stealc_v3 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file_e8219df7a9a21088.exe