Analysis
- user interaction
yes - max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 22:57
General
- Target Kryptex.exe
- Size 10.6MB
- Sample260919-2w9qtacd64
- SHA256 7775d333f0f61b4a6b29d11eb12a28405b74709ef0c4e67eea40e516ba255b05
Malware Config
Extracted
-
stealc
-
traff_1
-
http://193.233.254.53
-
url_path
/278c2fb3d8583f0e.php
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\Kryptex.exe"C:\Users\Admin\AppData\Local\Temp\Kryptex.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-1349-0x0000000000400000-0x0000000000650000-memory.dmp
memory/2484-1348-0x0000000000400000-0x0000000000650000-memory.dmp
memory/3332-0-0x0000000074642000-0x0000000074643000-memory.dmp
memory/3332-1-0x0000000000470000-0x0000000000774000-memory.dmp
memory/3332-2-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-3-0x0000000005A00000-0x0000000005B18000-memory.dmp
memory/3332-13-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-7-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-119-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-208-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-200-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-206-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-203-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-201-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-197-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-193-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-192-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-187-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-182-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-178-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-173-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-169-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-151-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-149-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-141-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-139-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-136-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-134-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-131-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-129-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-127-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-123-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-113-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-103-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-96-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-87-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-81-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-69-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-67-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-62-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-55-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-54-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-50-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-44-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-40-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-25-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-23-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-17-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-16-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-115-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-108-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-105-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-100-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-93-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-89-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-78-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-73-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-65-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-63-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-59-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-45-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-41-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-37-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-32-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-27-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-97-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-12-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-10-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-5-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-4-0x0000000005A00000-0x0000000005B12000-memory.dmp
memory/3332-1326-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1327-0x0000000005B40000-0x0000000005BB2000-memory.dmp
memory/3332-1328-0x0000000005DA0000-0x0000000005E10000-memory.dmp
memory/3332-1329-0x0000000005E30000-0x0000000005E7C000-memory.dmp
memory/3332-1330-0x0000000074642000-0x0000000074643000-memory.dmp
memory/3332-1331-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1332-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1334-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1335-0x0000000006790000-0x0000000006D4A000-memory.dmp
memory/3332-1336-0x0000000005EC0000-0x0000000005F14000-memory.dmp
memory/3332-1338-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1340-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1342-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1347-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/3332-1350-0x0000000074630000-0x0000000074DEC000-memory.dmp