Analysis
- max time kernel
149s - max time network
113s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 14:35
General
- Target 2026-04-22_5e2c01314d32765cdae25bccb9c5e898_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 770KB
- Sample260422-ryadmacy2s
- SHA256 bb276e13eba41bf4ea8cdc89c2a4d13d976e8235783177517738930258d290ff
Malware Config
Signatures
- Executes dropped EXE 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_5e2c01314d32765cdae25bccb9c5e898_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_5e2c01314d32765cdae25bccb9c5e898_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
StructuredQuerySchema.bin
msiexec.exe
memory/660-199-0x00007FF746EF0000-0x00007FF746FA1000-memory.dmp
memory/660-135-0x0000023315B10000-0x0000023315B76000-memory.dmp
memory/660-140-0x00007FF746EF0000-0x00007FF746FA1000-memory.dmp
memory/660-136-0x0000023315B10000-0x0000023315B76000-memory.dmp
memory/1108-170-0x00007FF7C95F0000-0x00007FF7C9707000-memory.dmp
memory/1108-78-0x000001B4C2100000-0x000001B4C2166000-memory.dmp
memory/1108-198-0x000001B4C19A0000-0x000001B4C1A4E000-memory.dmp
memory/1108-77-0x00007FF7C95F0000-0x00007FF7C9707000-memory.dmp
memory/1108-79-0x000001B4C2100000-0x000001B4C2166000-memory.dmp
memory/1664-155-0x00007FF79BDF0000-0x00007FF79BFDF000-memory.dmp
memory/1664-157-0x000002674C4B0000-0x000002674C516000-memory.dmp
memory/1664-156-0x000002674C4B0000-0x000002674C516000-memory.dmp
memory/1664-214-0x00007FF79BDF0000-0x00007FF79BFDF000-memory.dmp
memory/1900-188-0x00007FF73DD90000-0x00007FF73DE3B000-memory.dmp
memory/1900-119-0x00007FF73DD90000-0x00007FF73DE3B000-memory.dmp
memory/1900-117-0x0000023FC7070000-0x0000023FC70D6000-memory.dmp
memory/1900-118-0x0000023FC7070000-0x0000023FC70D6000-memory.dmp
memory/1900-208-0x0000023FC7590000-0x0000023FC763E000-memory.dmp
memory/2028-26-0x000002572A3E0000-0x000002572A446000-memory.dmp
memory/2028-153-0x000002572A8E0000-0x000002572A98E000-memory.dmp
memory/2028-28-0x00007FF6B5400000-0x00007FF6B54E7000-memory.dmp
memory/2028-29-0x000002572A3E0000-0x000002572A446000-memory.dmp
memory/2028-76-0x00007FF6B5400000-0x00007FF6B54E7000-memory.dmp
memory/2140-89-0x000001BBC0CB0000-0x000001BBC0D71000-memory.dmp
memory/2140-91-0x000001BBC0ED0000-0x000001BBC0F36000-memory.dmp
memory/2140-90-0x000001BBC0ED0000-0x000001BBC0F36000-memory.dmp
memory/2264-163-0x0000015743F40000-0x0000015743FEE000-memory.dmp
memory/2404-49-0x000001DFA87E0000-0x000001DFA8846000-memory.dmp
memory/2404-48-0x000001DFA87E0000-0x000001DFA8846000-memory.dmp
memory/2404-47-0x000001DFA8640000-0x000001DFA8701000-memory.dmp
memory/2980-175-0x000001F1CE360000-0x000001F1CE3C6000-memory.dmp
memory/2980-180-0x000001F1CE360000-0x000001F1CE3C6000-memory.dmp
memory/2980-173-0x000001F1CE360000-0x000001F1CE3C6000-memory.dmp
memory/2980-181-0x00007FF6190E0000-0x00007FF6194D0000-memory.dmp
memory/2980-174-0x00007FF6190E0000-0x00007FF6194D0000-memory.dmp
memory/3124-145-0x0000028C51BB0000-0x0000028C51C16000-memory.dmp
memory/3124-231-0x0000028C52190000-0x0000028C5223E000-memory.dmp
memory/3124-144-0x00007FF68A3C0000-0x00007FF68A684000-memory.dmp
memory/3124-146-0x0000028C51BB0000-0x0000028C51C16000-memory.dmp
memory/3124-210-0x00007FF68A3C0000-0x00007FF68A684000-memory.dmp
memory/3144-44-0x00000000009A0000-0x0000000000ACC000-memory.dmp
memory/3144-7-0x0000000002B50000-0x0000000002BB9000-memory.dmp
memory/3144-1-0x0000000002B50000-0x0000000002BB9000-memory.dmp
memory/3144-204-0x00000000009A0000-0x0000000000ACC000-memory.dmp
memory/3144-0-0x00000000009A0000-0x0000000000ACC000-memory.dmp
memory/3268-216-0x000002205F580000-0x000002205F5E6000-memory.dmp
memory/3268-217-0x00007FF6F4B50000-0x00007FF6F507B000-memory.dmp
memory/3268-246-0x00007FF6F4B50000-0x00007FF6F507B000-memory.dmp
memory/3268-215-0x000002205F580000-0x000002205F5E6000-memory.dmp
memory/3328-64-0x00007FF788860000-0x00007FF7889C8000-memory.dmp
memory/3328-65-0x000002E053180000-0x000002E0531E6000-memory.dmp
memory/3328-73-0x00007FF788860000-0x00007FF7889C8000-memory.dmp
memory/3328-66-0x000002E053180000-0x000002E0531E6000-memory.dmp
memory/3328-71-0x000002E053180000-0x000002E0531E6000-memory.dmp
memory/3372-126-0x00000298F1570000-0x00000298F15D6000-memory.dmp
memory/3372-222-0x00000298F1570000-0x00000298F15D6000-memory.dmp
memory/3372-225-0x00007FF6F8400000-0x00007FF6F882C000-memory.dmp
memory/3372-218-0x00000298F1A50000-0x00000298F1AFE000-memory.dmp
memory/3372-125-0x00000298F1570000-0x00000298F15D6000-memory.dmp
memory/3372-127-0x00007FF6F8400000-0x00007FF6F882C000-memory.dmp
memory/3372-193-0x00007FF6F8400000-0x00007FF6F882C000-memory.dmp
memory/3860-187-0x000002477B410000-0x000002477B4BE000-memory.dmp
memory/3860-56-0x000002477AF00000-0x000002477AF66000-memory.dmp
memory/3860-57-0x000002477AF00000-0x000002477AF66000-memory.dmp
memory/3860-55-0x000002477AD10000-0x000002477ADD1000-memory.dmp
memory/3872-41-0x000001B5375B0000-0x000001B537616000-memory.dmp
memory/3872-37-0x00007FF736930000-0x00007FF736BBB000-memory.dmp
memory/3872-35-0x000001B5375B0000-0x000001B537616000-memory.dmp
memory/3872-43-0x00007FF736930000-0x00007FF736BBB000-memory.dmp
memory/3872-36-0x000001B5375B0000-0x000001B537616000-memory.dmp
memory/3884-99-0x0000012080F50000-0x0000012080FB6000-memory.dmp
memory/3884-97-0x00007FF62BA20000-0x00007FF62BB67000-memory.dmp
memory/3884-98-0x0000012080F50000-0x0000012080FB6000-memory.dmp
memory/3884-182-0x00007FF62BA20000-0x00007FF62BB67000-memory.dmp
memory/3976-143-0x000001E7BEE10000-0x000001E7BEEBE000-memory.dmp
memory/3976-18-0x000001E7BE8D0000-0x000001E7BE936000-memory.dmp
memory/3976-16-0x000001E7BE8D0000-0x000001E7BE936000-memory.dmp
memory/3976-63-0x00007FF686820000-0x00007FF686907000-memory.dmp
memory/3976-15-0x00007FF686820000-0x00007FF686907000-memory.dmp
memory/4388-106-0x0000000000830000-0x0000000000899000-memory.dmp
memory/4388-105-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4388-111-0x0000000000830000-0x0000000000899000-memory.dmp
memory/4388-185-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4432-242-0x00000291BEE60000-0x00000291BEF0E000-memory.dmp
memory/4432-192-0x00000291BE960000-0x00000291BE9C6000-memory.dmp
memory/4432-191-0x00000291BE960000-0x00000291BE9C6000-memory.dmp
memory/4432-243-0x00007FF7D3C80000-0x00007FF7D414B000-memory.dmp
memory/4432-197-0x00007FF7D3C80000-0x00007FF7D414B000-memory.dmp
memory/4668-186-0x00007FF677B10000-0x00007FF677DCE000-memory.dmp
memory/4668-237-0x00007FF677B10000-0x00007FF677DCE000-memory.dmp
memory/4668-238-0x000002B6DC260000-0x000002B6DC30E000-memory.dmp
memory/4668-509-0x000002B6DC260000-0x000002B6DC30E000-memory.dmp
memory/4696-165-0x0000028D22B80000-0x0000028D22BE6000-memory.dmp
memory/4696-164-0x00007FF6932A0000-0x00007FF693432000-memory.dmp
memory/4696-227-0x00007FF6932A0000-0x00007FF693432000-memory.dmp
memory/4696-166-0x0000028D22B80000-0x0000028D22BE6000-memory.dmp