File name:

1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe

Full analysis: https://app.any.run/tasks/9cc8ece5-04d0-4f5c-85aa-c07fcc56b9e4
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Malware Trends Tracker     >>>
Analysis date: April 29, 2024, 10:30:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
stealc
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EDB1582F432AA2989CB72B89D999BED7

SHA1:

DDCF17C954E7DAB5059BE86202B9C856F55ACE48

SHA256:

1C03534E55F231C41F78AD9A110BC391E2C915DAA57F3A6CC115819FEAA33047

SSDEEP:

6144:nsMDNVMYfC0zC4Ql0Ma8EsmLU+zM44PGVNOkbawLz0l6AggkNSMnkr:soVMYqwC4Ql1a810zK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • STEALC has been detected (SURICATA)

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Connects to the CnC server

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

  • SUSPICIOUS

    • Windows Defender mutex has been found

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Contacting a server suspected of hosting an CnC

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Executes application which crashes

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Reads security settings of Internet Explorer

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Connects to the server without a host name

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

  • INFO

    • Checks supported languages

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Reads the computer name

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)

    • Checks proxy server information

      • 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe (PID: 4360)
      • WerFault.exe (PID: 4140)

    • Reads the software policy settings

      • WerFault.exe (PID: 4140)
      • slui.exe (PID: 4916)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 4140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:04 04:19:50+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 43008
InitializedDataSize: 40808448
UninitializedDataSize: -
EntryPoint: 0x160a
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 81.0.0.0
ProductVersionNumber: 31.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Patched, Private build, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #STEALC 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe sppextcomobj.exe no specs slui.exe werfault.exe slui.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4140C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4360 -s 1300C:\Windows\SysWOW64\WerFault.exe
1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4360"C:\Users\admin\AppData\Local\Temp\1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe" C:\Users\admin\AppData\Local\Temp\1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4916"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4924C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6568C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6636C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
5 198
Read events
5 186
Write events
12
Delete events
0

Modification events

(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4360) 1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6568) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
Executable files
0
Suspicious files
5
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
4140WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_1c03534e55f231c4_913674c0aa689195745951868d1d8398a6687ac0_f4bb33fa_206dc7c6-2d21-43e8-a622-25bea3559871\Report.wer —
MD5:—
SHA256:—
4140WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:BFA91EF770C64BE0F469E0F513D67306
SHA256:72604B648DD9C03F3B27421D8E91016A74B37E6FC86C2AD50F41A0898C09D84C
4140WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe.4360.dmpbinary
MD5:F4EB8FDE205B9A7426091C4B57C4FE45
SHA256:0DA1061B359DFB25C862C2AADCF1E3E95181F68CE66156D5A0A9C722DDECC4B2
4140WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER81F1.tmp.xmlxml
MD5:DF12F73A14A9A8C9E83D4AB4CD0C0A50
SHA256:C25FC3A925E4FA02C29C3425947D66B51B4C231F3C459DE985E09F33639861FF
4140WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER81C1.tmp.WERInternalMetadata.xmlxml
MD5:F0E1C8D5B2FB1AEDEB1D26337783D51B
SHA256:9F5B715BCB42DA3D6E9A12ADC6D5560DB145C41D484D73B44234EFBDC51CDBCD
4140WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:23E663AD81C9272BE5114F8C7E4DD1D5
SHA256:E8A891BD9CC0448A7E7A33E03CF14A184069FEE7BF1E2EB853FE06E517562948
6636FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-04-29.1031.6636.1.odlbinary
MD5:4F7C47465AD295FFE2640165321554B9
SHA256:19C364CEC6CF145A493EEE5EB80B3900CC761D6DA94DA290EF1AD625E11F580D
6636FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-04-29.1031.6636.1.aodlbinary
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3
SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94
4140WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER80F5.tmp.dmpbinary
MD5:16870FC31834E0ED65B166D17DCB47AF
SHA256:D86474110F4060BBBD02E90B94B8328B5843AA9863F4B4A3B583BC45DA4E08F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
56
DNS requests
22
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5576
svchost.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
1276
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6200
SIHClient.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6200
SIHClient.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
4140
WerFault.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5800
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
4360
1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
POST
200
185.172.128.151:80
http://185.172.128.151/7043a0c6a68d9c65.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5140
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5576
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5524
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5576
svchost.exe
95.101.89.217:80
www.microsoft.com
Akamai International B.V.
NL
unknown
4680
SearchApp.exe
2.18.29.224:443
www.bing.com
Akamai International B.V.
PL
unknown
4680
SearchApp.exe
2.18.29.208:443
www.bing.com
Akamai International B.V.
PL
unknown
1276
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4680
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
www.microsoft.com
  • 95.101.89.217
whitelisted
www.bing.com
  • 2.18.29.224
  • 2.18.29.225
  • 2.18.29.211
  • 2.18.29.216
  • 2.18.29.218
  • 2.18.29.208
  • 2.18.29.203
  • 2.18.29.210
  • 2.18.29.219
  • 2.18.29.240
  • 2.18.29.232
  • 2.18.29.120
  • 2.18.29.121
  • 2.18.29.233
  • 2.18.29.242
  • 2.18.29.122
  • 2.18.29.123
  • 2.18.29.234
whitelisted
r.bing.com
  • 2.18.29.208
  • 2.18.29.210
  • 2.18.29.203
  • 2.18.29.216
  • 2.18.29.211
  • 2.18.29.219
  • 2.18.29.224
  • 2.18.29.225
  • 2.18.29.218
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.75
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 23.32.157.163
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
4360
1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
4360
1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc
4360
1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047.exe