stealc | 5ae290938d33b652432e827944893b0bb5446564370f1ec6090022745b68a11f

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_f42a63c2d9521470161152e85738dcd1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 408KB
Sample260916-stw79sscmf
SHA256 5ae290938d33b652432e827944893b0bb5446564370f1ec6090022745b68a11f
MD5 f42a63c2d9521470161152e85738dcd1
SHA1 c7ebf7173b04fe92c3135de5bcf9fe15c3e86e95
SHA512 eaf2ad3058fbfa2ae5204dc6819e5a94edb25c0959b40275f9d5550f7ace316e32964ba515c75a821ac0f7620fe422c8bbe1de42109228912c0ec5f0a5331b6b
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohjo:YIfBoDWoyFbkU6hAJQnam
TLSH
T19A94BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stealc urelas stealer trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4112-22-0x0000000000400000-0x00000000004679C5-memory.dmp	family_stealc_v3

Executes dropped EXE 3 IoCs

pid	Process
4792	fybuh.exe
1864	jumixe.exe
2228	jugee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3216	cmd.exe
4388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fybuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jumixe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jugee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_f42a63c2d9521470161152e85738dcd1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe
2228	jugee.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4792	4112	2026-09-16_f42a63c2d9521470161152e85738dcd1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 4112 wrote to memory of 3216	4112	2026-09-16_f42a63c2d9521470161152e85738dcd1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 4792 wrote to memory of 1864	4792	fybuh.exe	91
PID 1864 wrote to memory of 2228	1864	jumixe.exe	93
PID 1864 wrote to memory of 4388	1864	jumixe.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-16_f42a63c2d9521470161152e85738dcd1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_f42a63c2d9521470161152e85738dcd1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\fybuh.exe
  "C:\Users\Admin\AppData\Local\Temp\fybuh.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Users\Admin\AppData\Local\Temp\jumixe.exe
    "C:\Users\Admin\AppData\Local\Temp\jumixe.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\jugee.exe
      "C:\Users\Admin\AppData\Local\Temp\jugee.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 ddbbc6dd25afd426aee96fa1d75ddce762c67ea9e2c85806794adb614a3a16e8
MD5 823e047fd5534d01a484ee7b5113aa00
SHA1 6a071b6dd2688a16c12d022207559c7cba221c0e
SHA512 74713f4f42a9d4d40cb4194cf8b6fd3c345f5a1ab38819b7abf71cd002fcb965958c9dc67dc284af11b99e9e255eb9899e52fe307a2411a21dcec7320c8a5c86
TLSH
T15FD0C71241D6E7AE1848942B4AF6668DC0B54C9D3F473B119721C4CC61C141DF5C7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 c403a408feba0418e9e7bcf247256bd4bd3028df189aec0e64eb1b220461a634
MD5 79c69539a4a7546598d236e8731810d9
SHA1 5c98821249d8bb25b0c058804047c1fdee965735
SHA512 bb50baffa1aad643a72a7f7a7c1962bbaa5ad93ec12533df8657345e956a3dac2a34502cdace700c6d9b7eca87c6659e786ff4436947784f2d8d0a71f9afd799
TLSH
T1BCE09B4201BFDE6B111CC02F15B67A8D825459787FC77BB07621C69D51D585EF4B3243
MD5 SHA1 SHA512 TLSH

Submit Download

fybuh.exe

Path C:\Users\Admin\AppData\Local\Temp\fybuh.exe
Size 408KB
SHA256 275eab0c9b217e6aeb1b9aee25e634df7415499d49a48b4b22854963470c715a
MD5 10796fb2bfa89355c0498fe92b2773b1
SHA1 ba9b30a70bf4b6b0a1dd2a826d7345176f5061ba
SHA512 ec8016a2e7a6d69258246d0ef634ae20f7d3f3f32c510a62a5e02a586d917a5e2298572ac475c128ffd17f1ceef57a31949c4f3adbaa09516fde7c8bfbc1e181
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohjg:YIfBoDWoyFbkU6hAJQnaq
TLSH
T19E94BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1689ed348c47302bf00f2321091c465bbb165c7256cba37f1a3f2208860c4cdb
MD5 ac6a5ed442276c6378f4cd44263ccd6b
SHA1 5645ecbdd12d7b0097edf45403c9ea044fc7bf09
SHA512 5923b88fd1569b57e2591d0f102fdd6a9ab5d3b40c35a8e7d7abfcd0b8c561055577d22d9a060992ba376da61d3cb503a03b950a0ada517c9334f0968d3818c0
TLSH
T1ECF04CE11065A0557515E613F39417E667E30E841F879C444109B1709E76D7C4C04695
MD5 SHA1 SHA512 TLSH

Submit Download

jugee.exe

Path C:\Users\Admin\AppData\Local\Temp\jugee.exe
Size 223KB
SHA256 9ff961653fd2106de2424a5a66a9b7f867454814705a112d7822403395c6d173
MD5 e2a408cbe1006a135213348c2428b93d
SHA1 8a3572a063e4eb7a53e36192c93ee6423c6ab8fc
SHA512 9a8b75f1094d372f4851817745d295cd34ffbbc76d3965a4657b4aa9347dc5f57a249e63222ffb86947164cf054bc80d3a78bc0615837d4889427a73f375de32
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3H:unFhSIkAyDgjtS/FZt
TLSH
T1CF24E041AA018888F38C4B316A17FAE449898D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jumixe.exe

Path C:\Users\Admin\AppData\Local\Temp\jumixe.exe
Size 408KB
SHA256 657f32cbfc642b29fc6d6b02b7aa7ab417fdeec18017e5f3543a5c2a0ecc4a98
MD5 263b5ca6bd90f1d6c2a87a60fe1ea85d
SHA1 7fde4f427df231ca2a472fa1542b931ab1caae31
SHA512 61c898f3cf371340616bb4df8e84bcadf35de4e368bb7812a85fb7e5b9f885cc1fb9e6ec0c6c9fdecce5e69aa5f8f5c731917cc6dc38a920a8a5864c833f6948
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohjK:YIfBoDWoyFbkU6hAJQnak
TLSH
T1D594BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1864-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1864-33-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1864-53-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2228-56-0x0000000000CA0000-0x0000000000D40000-memory.dmp

Download

memory/2228-44-0x0000000000CA0000-0x0000000000D40000-memory.dmp

Download

memory/2228-55-0x0000000000CA0000-0x0000000000D40000-memory.dmp

Download

memory/2228-57-0x0000000000CA0000-0x0000000000D40000-memory.dmp

Download

memory/2228-58-0x0000000000CA0000-0x0000000000D40000-memory.dmp

Download

memory/2228-59-0x0000000000CA0000-0x0000000000D40000-memory.dmp

Download

memory/4112-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4112-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4112-22-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4792-18-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4792-31-0x0000000000400000-0x00000000004679C5-memory.dmp

Download