stealc | 0c805d4a2ca434ed907f3cb14f4b5880f26ffc2e91cd0b86302fae5fab68c333

Analysis

max time kernel
150s
max time network
87s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260912-pre97aztct
SHA256 0c805d4a2ca434ed907f3cb14f4b5880f26ffc2e91cd0b86302fae5fab68c333
MD5 1e5cf592f0f10efa7e323e336be402d4
SHA1 b2075de314acdc38dd8232e5fd812177589256a7
SHA512 f321fafea658db39eda2155dc52fffc596fcbaa399be3121212dd21035e8adb283726e5e170919ef62a36077158c34471dc8e121a9e0111874c2c0680425b7bd
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFO:NMvrRb/G8+HO
TLSH
T180168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stealc urelas stealer trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4144-21-0x00000000009C0000-0x0000000000DB2000-memory.dmp	family_stealc_v3

Executes dropped EXE 2 IoCs

pid	Process
4664	cypoq.exe
1692	seifa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3820	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2512	1692	WerFault.exe	91
6092	1692	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cypoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seifa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4664	4144	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe	88
PID 4144 wrote to memory of 3820	4144	2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 4664 wrote to memory of 1692	4664	cypoq.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_1e5cf592f0f10efa7e323e336be402d4_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\cypoq.exe
  "C:\Users\Admin\AppData\Local\Temp\cypoq.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\seifa.exe
    "C:\Users\Admin\AppData\Local\Temp\seifa.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 256
      4⤵
      Program crash
      PID:2512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 276
      4⤵
      Program crash
      PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1692 -ip 1692
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1692 -ip 1692
1⤵
PID:5524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 d0966b8dd3acf8c2bf101c64bc59d726fb3732d374aed3098dc30399ca6f7c58
MD5 52f2a93a5c4ef7101f14f230330fde49
SHA1 fbb847ed543b54344686bf3ed38bf41eac09d245
SHA512 f7956909f80fca4e7b99ee3c15a2061f40400268fea0940b697c45e95fd607454f62b7bbf7154c25fc36302f264bedc6693bf92abd833a350b29926eb9ef208d
TLSH
T11CE0D800AC9ECA7E545CD02F0575A28DC0616EECAF4527129A31C68E21DF94EB9D2733
MD5 SHA1 SHA512 TLSH

Submit Download

cypoq.exe

Path C:\Users\Admin\AppData\Local\Temp\cypoq.exe
Size 3.9MB
SHA256 eb6d6c9a51617e59ffe5cc5bd8f27cd569912e204477e4f47b122c07c1d86528
MD5 144420f5c4d8af0f4dcc5693dfc6a753
SHA1 bfb2b8b20a774d4d546806f800ec8bb816a13e31
SHA512 d083482c28600a15dc655762a3fc60701764cd913fd11d97e6376e3cf093e8ca942280411be7202f5521acab0c9c422be8e7643bbbb916e0286f1de53d1c9a77
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFS:NMvrRb/G8+HS
TLSH
T163168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3a7b7365af513508c37d3e9950dcec328bfa10898da7038786cf95b1931a545f
MD5 8acf5b1e65568dce8aec34909c65c30a
SHA1 0b2acd6ec3d2373b9a77e3e0bff748ae3c7a5bcb
SHA512 6e458f1548dfb0a49206502e002f702255db1e8951919523e93bf3d3d9fb49e28b9de9214fe1695270bf294e7b5f289e27a347d5771a8281949ebccc901fde5b
TLSH
T13EF04CD55462A5653622F302E2846B5567B30DC62D835D940504F6704E35E2C8554395
MD5 SHA1 SHA512 TLSH

Submit Download

seifa.exe

Path C:\Users\Admin\AppData\Local\Temp\seifa.exe
Size 231KB
SHA256 b6ed281d7267e9aac0df5fde1a546fade3ffe4b7c976cf99b5d26484224e7e81
MD5 ad0a0dd4f25999aceda4ee898ee8489d
SHA1 71ac177d88f8c9264029b52b48450b97bd3f1555
SHA512 1f804ee2f4e93358196e54d08413d06c72ef396fe6567ec41d2ef4ca6264971d78e79b8622671bb6c8ca54c2ae4684d682e1d00c1dde9328f9709f495d373f3b
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpi0:z6r5cTfS/ZPHUWoQISzqJBpi0
TLSH
T18534D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-36-0x00000000003F0000-0x00000000004A3000-memory.dmp

Download

memory/1692-33-0x00000000003F0000-0x00000000004A3000-memory.dmp

Download

memory/4144-21-0x00000000009C0000-0x0000000000DB2000-memory.dmp

Download

memory/4144-0-0x00000000009C0000-0x0000000000DB2000-memory.dmp

Download

memory/4144-1-0x00000000009EB000-0x00000000009EC000-memory.dmp

Download

memory/4664-24-0x0000000000C50000-0x0000000001042000-memory.dmp

Download

memory/4664-13-0x0000000000C50000-0x0000000001042000-memory.dmp

Download

memory/4664-14-0x0000000000C7B000-0x0000000000C7C000-memory.dmp

Download

memory/4664-35-0x0000000000C50000-0x0000000001042000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads