Analysis
- max time kernel
120s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 02:02
General
- Target bhatta.exe
- Size 8.9MB
- Sample261110-cgmkascc53
- SHA256 5c113804b804fb934afe84965e69a2bd912cef31203b2e4f367d8986b8783c93
Malware Config
Extracted
-
stealc
-
5
-
http://46.151.182.211
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: VorishkaStealer
VorishkaStealer is a Windows stealer written in C++.
- Detects Stealc stealer Version 3 16 IoCs
- Detects VorishkaStealer 44 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bhatta.exe"C:\Users\Admin\AppData\Local\Temp\bhatta.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HDgaX.exe"C:\Users\Admin\AppData\Local\Temp\HDgaX.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { try { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\2026-11-10 02.03.13\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\2026-11-10 02.03.13\result.zip' -Force -ErrorAction Stop; exit 0 } catch { exit 1 } }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Cookies
History
Login Data
Top Sites
Web Data
Cookies
History
Login Data
Top Sites
Web Data
cert9.db
cookies.sqlite
key4.db
SystemInfo.txt
V10.txt
monitor_0_1794276196163.png
result.zip
HDgaX.exe
__PSScriptPolicyTest_dxroszx2.iuf.psm1
memory/1088-117-0x0000020B4C650000-0x0000020B4C65A000-memory.dmp
memory/1088-115-0x0000020B4C670000-0x0000020B4C67A000-memory.dmp
memory/1088-114-0x0000020B64CE0000-0x0000020B64D92000-memory.dmp
memory/1088-113-0x0000020B4C650000-0x0000020B4C66E000-memory.dmp
memory/1088-116-0x0000020B4C660000-0x0000020B4C672000-memory.dmp
memory/1088-108-0x0000020B4C5A0000-0x0000020B4C5C2000-memory.dmp
memory/1624-62-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-96-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-21-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-139-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-36-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-34-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-31-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-42-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-43-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-44-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-47-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-50-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-53-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-51-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-49-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-59-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-61-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-28-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-60-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-70-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-69-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-68-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-73-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-75-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-78-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-80-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-82-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-85-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-86-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-92-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-94-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-25-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-101-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-99-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-104-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-30-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-107-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-29-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-35-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-27-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-26-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-24-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-23-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1624-22-0x0000000140000000-0x000000014011D000-memory.dmp
memory/1864-40-0x0000013C6FAB0000-0x0000013C6FAB5000-memory.dmp
memory/2532-106-0x00000129185F0000-0x00000129185F5000-memory.dmp
memory/4920-32-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-20-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-14-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-10-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-9-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-8-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-18-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-16-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-17-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-13-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-15-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-38-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-37-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-11-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-12-0x0000000140000000-0x00000001400D7000-memory.dmp
memory/4920-19-0x0000000140000000-0x00000001400D7000-memory.dmp