Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe
- Size 323KB
- Sample260519-dct91sft5w
- SHA256 880933def6a9930e93b2df9bfb5ff880aaf988a85423d65f565e2faaa2eca8d8
- MD5 1f55b93188c82d4eb8cd8b46f991e873
- SHA1 d36bdb297db4862e92646dd48ce9279dd11fd65f
- SHA512 263ec6b184424edbb3654a1ad7ef5ee2960f282f9872b018247bb2a762f196579627db43597da9e80b1a9f8808ba662322170e402b476d25c9202dd0e82400f0
- SSDEEP 6144:/0kHUZNuWudtvkaDmEj11isvh/+LsFfNNBfNkhzSh:/rU+tcEjiO6sLNB4zS
- TLSH T166649E18F9D0C076C49270B2856AD7F299F9B8B01F65B6CBBBC805784F786D1663270E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4980 p2xd3zaaawlyhmysua9y.exe 2136 rbghcebfhw.exe 3472 ynjvzgwqflwo.exe 3872 rbghcebfhw.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\jdstjatyiq\qxljiertofah 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe File created C:\Windows\jdstjatyiq\qxljiertofah p2xd3zaaawlyhmysua9y.exe File created C:\Windows\jdstjatyiq\qxljiertofah rbghcebfhw.exe File created C:\Windows\jdstjatyiq\qxljiertofah ynjvzgwqflwo.exe File created C:\Windows\jdstjatyiq\qxljiertofah rbghcebfhw.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbghcebfhw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p2xd3zaaawlyhmysua9y.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2136 rbghcebfhw.exe 2136 rbghcebfhw.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe 3472 ynjvzgwqflwo.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4728 wrote to memory of 4980 4728 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe 87 PID 2136 wrote to memory of 3472 2136 rbghcebfhw.exe 90 PID 4980 wrote to memory of 3872 4980 p2xd3zaaawlyhmysua9y.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\jdstjatyiq\p2xd3zaaawlyhmysua9y.exe"C:\jdstjatyiq\p2xd3zaaawlyhmysua9y.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\jdstjatyiq\rbghcebfhw.exe"C:\jdstjatyiq\rbghcebfhw.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3872
-
-
-
C:\jdstjatyiq\rbghcebfhw.exeC:\jdstjatyiq\rbghcebfhw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\jdstjatyiq\ynjvzgwqflwo.exesmcudvzx8a8b "c:\jdstjatyiq\rbghcebfhw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3472
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\jdstjatyiq\p2xd3zaaawlyhmysua9y.exe
- Size 323KB
- SHA256 880933def6a9930e93b2df9bfb5ff880aaf988a85423d65f565e2faaa2eca8d8
- MD5 1f55b93188c82d4eb8cd8b46f991e873
- SHA1 d36bdb297db4862e92646dd48ce9279dd11fd65f
- SHA512 263ec6b184424edbb3654a1ad7ef5ee2960f282f9872b018247bb2a762f196579627db43597da9e80b1a9f8808ba662322170e402b476d25c9202dd0e82400f0
- SSDEEP 6144:/0kHUZNuWudtvkaDmEj11isvh/+LsFfNNBfNkhzSh:/rU+tcEjiO6sLNB4zS
- TLSH T166649E18F9D0C076C49270B2856AD7F299F9B8B01F65B6CBBBC805784F786D1663270E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\jdstjatyiq\qxljiertofah
- Size 11B
- SHA256 4cfe53dce4fa1e9aae2e0c72297ebce85b57ba880ac736a0263e7500e496d31c
- MD5 252d173d7e992e225029cba1d5e08f24
- SHA1 2bd8507c60eea24713b4183ac81aafc4f31b6ac2
- SHA512 0fa7839fd1ebf306fe49710db2d3a05e534a882d73ff9133d4fb24f308d8989c6d80296daa7c705618a871fb8e9779055831dff28934c6b4cad19c96f4b745fb
- MD5 SHA1 SHA512
- Path C:\jdstjatyiq\tckqx6
- Size 4B
- SHA256 db06852176ce46893b362106a3bc35eef8b62cbf67f4f6fdf5ae8928d1c40733
- MD5 1f4698d878384a51c39d3397a676c261
- SHA1 8ceda798e80d94520cbea4a7ba5700498b4587d3
- SHA512 0aa823b09ec349c0a3f2e38552b30b63335bbbd2315fa4147532dc71d71e183e07c74c8c4905ddab8888171d297820b0180092dda748d010172f4168f9e81092
- MD5 SHA1 SHA512