stealc | 2cf38865a2efdd71699fb7790ee87b4729e5f63ba1439652299c6d2af02874d2

Analysis

max time kernel
149s
max time network
109s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_5819adb4a9bc41735fb7629a4fa27fe2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 408KB
Sample260916-pl8dsat14n
SHA256 2cf38865a2efdd71699fb7790ee87b4729e5f63ba1439652299c6d2af02874d2
MD5 5819adb4a9bc41735fb7629a4fa27fe2
SHA1 3908d4158d6731955d343346881518b71f5052ca
SHA512 a1ee56962fe54ef894c7ea74bffcf37d500ff79f2876669d246698465475c6499c60c1f83ca3237ad90c4364375fc00536589c74c91d398f003db7dff48f0ef1
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohfx:YIfBoDWoyFbkU6hAJQnaz
TLSH
T16E94BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stealc urelas stealer trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/6100-22-0x0000000000400000-0x00000000004679C5-memory.dmp	family_stealc_v3

Executes dropped EXE 3 IoCs

pid	Process
5844	himin.exe
4188	rokepu.exe
2892	naroz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5256	cmd.exe
5976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_5819adb4a9bc41735fb7629a4fa27fe2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	himin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rokepu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	naroz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe
2892	naroz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 5844	6100	2026-09-16_5819adb4a9bc41735fb7629a4fa27fe2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	87
PID 6100 wrote to memory of 5256	6100	2026-09-16_5819adb4a9bc41735fb7629a4fa27fe2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 5844 wrote to memory of 4188	5844	himin.exe	90
PID 4188 wrote to memory of 2892	4188	rokepu.exe	92
PID 4188 wrote to memory of 5976	4188	rokepu.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-16_5819adb4a9bc41735fb7629a4fa27fe2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_5819adb4a9bc41735fb7629a4fa27fe2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Users\Admin\AppData\Local\Temp\himin.exe
  "C:\Users\Admin\AppData\Local\Temp\himin.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Users\Admin\AppData\Local\Temp\rokepu.exe
    "C:\Users\Admin\AppData\Local\Temp\rokepu.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\naroz.exe
      "C:\Users\Admin\AppData\Local\Temp\naroz.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 f78405633134659e35e3c54fcb3cfba4acc6a10525a9f2c3e162a28312135433
MD5 b22893c6bc585fc74ee2acfe1c556369
SHA1 8e87cc61cc9643a49d54015a8e28d8cc1146671b
SHA512 77099899150256f8219e51ef71b952c70e245c6ca23d4f6b4daa88e6486998a080a37bc8129fdcd70c9c97fd26d1940d8fe57deb0eb0d509b3db58c0ae83fb3c
TLSH
T1C8E02B1041EFED7B004CC01F05A6AACD80A05A543F8A3B313611C30C61ED85EB4A6351
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 7828c250158e5f5fa9fdd95b417009a5729b7839020909c245636fb5702ded70
MD5 a9ea26356fcc63b1fef7bd2db02560c2
SHA1 24d8cb29c95a14a8a2037ed3b706e79d294fc791
SHA512 a827f782afc3c5ac5491fba0969907f3f46475a1075f76cf7c40562385ee5ded6aa178cd774c766fcd3f7b35164697afb66f20060ac8e73b71147b6685c9d6e3
TLSH
T185D0C71546DAD75F0548943B06B5B1CDC0754C5C3F473B119B21C44C61C141DF9C7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1959405ae95aa9c095ed3c51870306596047bac99053fbd5e7dcc5793e30598a
MD5 deb16d8698d02cf9dfb6b4d32f5a873c
SHA1 75cb70a0dbbf7e6d4dceb8100f00c08bb310d2c4
SHA512 0f8e0dcc5b40802bd4ce702418900366be8ca1f595526bde509408d06c78008335534271c3a4b3f5a29d90d8f7269eaf73fc7df0d10cd0e4153ad6ffdcbfd88e
TLSH
T11DF04CDD2051B85A7611A627C69417A923930DA518879D98048571648DB593D8454356
MD5 SHA1 SHA512 TLSH

Submit Download

himin.exe

Path C:\Users\Admin\AppData\Local\Temp\himin.exe
Size 408KB
SHA256 fa59240f8eac040b23ef270438facaa4efce94cebf3ef71de6b9b753cf345be8
MD5 4b0dc6e1d2ca92f837f76cc2fcd7ef44
SHA1 1baa122a399f8403f586a22bfb338b0def541ded
SHA512 b12758b913980fd21a1d35abeab9e4f0f385e6f659e3a9ce950d618a059884957779c91f156b68aed2f6fc5aad180c9e637c1e549821e7c40bed931e41ceb182
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohfW:YIfBoDWoyFbkU6hAJQnac
TLSH
T1AF94BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naroz.exe

Path C:\Users\Admin\AppData\Local\Temp\naroz.exe
Size 223KB
SHA256 41709dd8d01d4293d181d5f495fc1712fb150b563e908ed0326f10f6e2ae8324
MD5 bd052b0e974d6b3c2ed9a799e0d13ba1
SHA1 5e7d1287dcc1d4acc26b86c922c457c3b6984023
SHA512 c1cd1f670939d6b423dda966788fe94001de6e1be0176b18e9840cec95357f59407755874189a29dcdd58fae67d41cde82db3303b152b4c69a05b4201582781a
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3o:unFhSIkAyDgjtS/FZW
TLSH
T16E24E042AA018888F38C4B316A17FAE449858D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rokepu.exe

Path C:\Users\Admin\AppData\Local\Temp\rokepu.exe
Size 408KB
SHA256 ea6f12f30367d8b13fadb425e7502a874fa55631feec2aabe3db24df31dc9c29
MD5 a3024e20a7b563f05b1c80581e8bfe1c
SHA1 e7d440b358425b2a0e8d95c25797a5a171a30617
SHA512 6852f229601c8ffdbb0956e97b1e258087c7b424a73e100e883be1585349c2045baaf47d573eeeaa7259453b133d9fb9e695659cf8d17688a2bda387507bd237
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohfq:YIfBoDWoyFbkU6hAJQna8
TLSH
T16A94BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2892-55-0x00000000000B0000-0x0000000000150000-memory.dmp

Download

memory/2892-44-0x00000000000B0000-0x0000000000150000-memory.dmp

Download

memory/2892-59-0x00000000000B0000-0x0000000000150000-memory.dmp

Download

memory/2892-58-0x00000000000B0000-0x0000000000150000-memory.dmp

Download

memory/2892-57-0x00000000000B0000-0x0000000000150000-memory.dmp

Download

memory/2892-56-0x00000000000B0000-0x0000000000150000-memory.dmp

Download

memory/4188-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4188-53-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4188-33-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5844-14-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5844-32-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/6100-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/6100-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/6100-22-0x0000000000400000-0x00000000004679C5-memory.dmp

Download