stealc | 20d7fe7052bd394e69662f3ae59e21f8a01541617f1149c79edbf884c6c07213

General

Target
2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Size 2.4MB
Sample261002-ctjdeazyb1
SHA256 20d7fe7052bd394e69662f3ae59e21f8a01541617f1149c79edbf884c6c07213
MD5 cd3c2d665fb92833dd00df810f4318ba
SHA1 303ee0132c76f73a3b320716dddcd32beb63b09b
SHA512 22e8fa8c5e66cf1b0a9d85d6ee52829853cf56308677dfedaa7ac087379a019b682a7f428518dfe62fa2464994a14e49d9598bb78a883bd3ba3c9b9eab052a3e
SSDEEP 49152:MMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1BzueJ7kk8:MMDtIXLr06AdfEThF35Pzuee
TLSH
T18DC5232572F2C031D597057119EAC2B1037DF5704EA4BA6FB7E14B9D1FB20E2362AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution stealc persistence stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/1360-25-0x0000000000400000-0x00000000004C0000-memory.dmp	family_stealc_v3

Executes dropped EXE 2 IoCs

pid	Process
1360	2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
4112	maintenance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4236	cmd.exe
3364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6136	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5620	schtasks.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 3364	824	2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 824 wrote to memory of 4236	824	2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3364 wrote to memory of 6056	3364	cmd.exe	93
PID 4236 wrote to memory of 1084	4236	cmd.exe	94
PID 3364 wrote to memory of 5620	3364	cmd.exe	95
PID 4236 wrote to memory of 1360	4236	cmd.exe	96
PID 4236 wrote to memory of 6136	4236	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe20261022225768.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx20261022225768.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb20261022225768.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_cd3c2d665fb92833dd00df810f4318ba_coinminer_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1360
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:6136

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb20261022225768.bat

Path C:\Users\Admin\AppData\Local\Temp\zb20261022225768.bat
Size 908B
SHA256 a0b8bfd1d1459439869325f54b969169afbbf4ee481251b143c8dd1704131ec3
MD5 9393f554279aacc4a92c87c830a59d4b
SHA1 2094e053e722492c9578df654f24ac382b8fc39e
SHA512 39a91b9842c17741ebea5a57d5119b510046c47c4775763df276d61eb84366343fc55c562979934b85aa41f9cc4e29404a216691da6e2e598536ec6026c472a5
TLSH
T1B01190418187CF79091D936B04B9B84DC0A218A8BD443A312720D58C46CACEDF9A376A
MD5 SHA1 SHA512 TLSH

Submit Download

zbe20261022225768.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe20261022225768.bat
Size 398B
SHA256 5b47c04de50c8528fb0710cd13050d9eee579b72d3c0868c8214f9d76f47d1d7
MD5 8f9435d979891d2b17b50ed18f05e69c
SHA1 5749e55f76c09b872f3289cb2171225fa76e8fed
SHA512 09217a6a51a119e0059eacfe0f471637b77ae38596f85315358c2daa319eae65a1ec2d8c248863a3689bcdbb135eab9532fcba31c4bc99582031e9f0223bc1df
TLSH
T149E0F12B1313844C209CB68B70D75702DCB5207FB3E3B1045A968C1484C725BEC9B342
MD5 SHA1 SHA512 TLSH

Submit Download

ze20261022225768.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze20261022225768.tmp
Size 2.4MB
SHA256 9c1258cb656760e3086f66d7915ca74d127f99cbba0e40467ecf8a6bf402184d
MD5 1f4ef3cd3cadfba011a46da7e16d57d8
SHA1 8dd3fe174487ede8d0e727084a7b5be5ea5be588
SHA512 10b403c015d78d5290563fa69b2d0a27f30530fe312376c0c0db060f644d4203edacd141b0a34b8f5a3bf7a3b313dbc9a57417f03ed58b84781d5849f4cbc578
SSDEEP 24576:sK1npBkki2blywTXHWUBaSycop/C+ZrenQ+yn7U8R3FDmXNjw8A7ZsDVvw8wHIyH:TJ7kkfywcLen7QD/7uxKILLEZVk6y6
TLSH
T167C533203BE4A076DA36033006F4D2715879BD754AA4AD2BBBE88B5D1E705C1FB75B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx20261022225768.xml

Path C:\Users\Admin\AppData\Local\Temp\zx20261022225768.xml
Size 1KB
SHA256 d7985d451fdf444635d449df3a06e1b696088421608fe5dec4f62f549657a552
MD5 e863ad7cb8f00bd3767195091014af85
SHA1 eec478617584c976086ccfed5b68b3c912daccfe
SHA512 aaec082c34fee4f02d8ef19cbb0377d83bede283e67f94d8dd6e8d9347bcbc37b81da281f936cd3bc54809c5eb788602605886e276f4744ea0db88b1b0b94b85
TLSH
T13531E3589CC0B72BB533922BE7515282EF758393456A4028F4CC4B7B1FF614A6153567
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-23-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1360-25-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads