stealc | 0c805d4a2ca434ed907f3cb14f4b5880f26ffc2e91cd0b86302fae5fab68c333

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260912-pre97aztct
SHA256 0c805d4a2ca434ed907f3cb14f4b5880f26ffc2e91cd0b86302fae5fab68c333
MD5 1e5cf592f0f10efa7e323e336be402d4
SHA1 b2075de314acdc38dd8232e5fd812177589256a7
SHA512 f321fafea658db39eda2155dc52fffc596fcbaa399be3121212dd21035e8adb283726e5e170919ef62a36077158c34471dc8e121a9e0111874c2c0680425b7bd
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFO:NMvrRb/G8+HO
TLSH
T180168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stealc urelas stealer trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects Stealc stealer Version 3 3 IoCs

resource	yara_rule
behavioral1/memory/4960-0-0x00000000002D0000-0x00000000006C2000-memory.dmp	family_stealc_v3
behavioral1/memory/4960-16-0x00000000002D0000-0x00000000006C2000-memory.dmp	family_stealc_v3
behavioral1/memory/4480-29-0x00000000006C0000-0x0000000000AB2000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	fogej.exe

Executes dropped EXE 2 IoCs

pid	Process
4480	fogej.exe
2532	fymog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4336	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4728	2532	WerFault.exe	88
1300	2532	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fymog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fogej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4480	4960	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe	83
PID 4960 wrote to memory of 4336	4960	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe	84
PID 4480 wrote to memory of 2532	4480	fogej.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\fogej.exe
  "C:\Users\Admin\AppData\Local\Temp\fogej.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Users\Admin\AppData\Local\Temp\fymog.exe
    "C:\Users\Admin\AppData\Local\Temp\fymog.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 216
      4⤵
      Program crash
      PID:4728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 224
      4⤵
      Program crash
      PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2532 -ip 2532
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2532 -ip 2532
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 d0966b8dd3acf8c2bf101c64bc59d726fb3732d374aed3098dc30399ca6f7c58
MD5 52f2a93a5c4ef7101f14f230330fde49
SHA1 fbb847ed543b54344686bf3ed38bf41eac09d245
SHA512 f7956909f80fca4e7b99ee3c15a2061f40400268fea0940b697c45e95fd607454f62b7bbf7154c25fc36302f264bedc6693bf92abd833a350b29926eb9ef208d
TLSH
T11CE0D800AC9ECA7E545CD02F0575A28DC0616EECAF4527129A31C68E21DF94EB9D2733
MD5 SHA1 SHA512 TLSH

Submit Download

fogej.exe

Path C:\Users\Admin\AppData\Local\Temp\fogej.exe
Size 3.9MB
SHA256 65bffc588efe2d5e462d2857736e6451b975525fde7a7eccbeb9f0af655c5a8e
MD5 763e68b8bb831f29c3f49fff79a3abcb
SHA1 39a93d60a592c1639f2de4e24caa787da6f82463
SHA512 bf6316cff606d122de3359eb2059a0ed2e657f7d23d09b936e3c64948c3f67db2a4fbb7484343702eff8945fe6ea37ba03d6f2c3e5f675452e6f86ee114487a8
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFN:NMvrRb/G8+HN
TLSH
T10F168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fymog.exe

Path C:\Users\Admin\AppData\Local\Temp\fymog.exe
Size 231KB
SHA256 6d36620afe599ab941a9c6f0a8739e791329c85e171b5b60ae0c52ee4c0ef01b
MD5 fb6e0145c9aa4d5516223ceab97d8ca0
SHA1 e2ef446790b51db6f3de170705fe7bd2a8e7feea
SHA512 52917565e1de5812653909f8a2d724acda83bb037490f57685497fe4643e7c4a447b1eb51c36608700fccd8fe8d5341a6f170cdcdb0782f600e73fb42a8e06b6
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpi/p:z6r5cTfS/ZPHUWoQISzqJBpiB
TLSH
T18C34E06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a324c65244d0c1eaf82893f2c5f92675ad69c0f9b636833e70d3f7d745dd0f65
MD5 4e1d5c1e3394393d91e52513b1ec59c0
SHA1 defa6e2034e26c89ebf2ba48ea2f0d66cfdacd84
SHA512 0ee69a25cb2ae040961e02110b86c135092ddac2746e81eda98497ffff67067d76619929fcd7200df8aba25f849cb96fda221ecb08e0a5c41572aa48db23e7b3
TLSH
T1F9F09BD95075E1593711F511E7D5275D27E71D8C28475D880108B1704A75E3C45543D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-30-0x0000000000D20000-0x0000000000DD3000-memory.dmp

Download

memory/2532-27-0x0000000000D20000-0x0000000000DD3000-memory.dmp

Download

memory/4480-15-0x00000000006EB000-0x00000000006EC000-memory.dmp

Download

memory/4480-14-0x00000000006C0000-0x0000000000AB2000-memory.dmp

Download

memory/4480-19-0x00000000006C0000-0x0000000000AB2000-memory.dmp

Download

memory/4480-29-0x00000000006C0000-0x0000000000AB2000-memory.dmp

Download

memory/4960-16-0x00000000002D0000-0x00000000006C2000-memory.dmp

Download

memory/4960-1-0x00000000002FB000-0x00000000002FC000-memory.dmp

Download

memory/4960-0-0x00000000002D0000-0x00000000006C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads