Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe
- Size 323KB
- Sample260519-dct91sft5w
- SHA256 880933def6a9930e93b2df9bfb5ff880aaf988a85423d65f565e2faaa2eca8d8
- MD5 1f55b93188c82d4eb8cd8b46f991e873
- SHA1 d36bdb297db4862e92646dd48ce9279dd11fd65f
- SHA512 263ec6b184424edbb3654a1ad7ef5ee2960f282f9872b018247bb2a762f196579627db43597da9e80b1a9f8808ba662322170e402b476d25c9202dd0e82400f0
- SSDEEP 6144:/0kHUZNuWudtvkaDmEj11isvh/+LsFfNNBfNkhzSh:/rU+tcEjiO6sLNB4zS
- TLSH T166649E18F9D0C076C49270B2856AD7F299F9B8B01F65B6CBBBC805784F786D1663270E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1328 p2xd3za7y9lyhmysua9y.exe 5048 rbghcebfhw.exe 3924 ynjvzgwqflwo.exe 2296 rbghcebfhw.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\jdstjatyiq\qxljiertofah 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe File created C:\Windows\jdstjatyiq\qxljiertofah p2xd3za7y9lyhmysua9y.exe File created C:\Windows\jdstjatyiq\qxljiertofah rbghcebfhw.exe File created C:\Windows\jdstjatyiq\qxljiertofah ynjvzgwqflwo.exe File created C:\Windows\jdstjatyiq\qxljiertofah rbghcebfhw.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p2xd3za7y9lyhmysua9y.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbghcebfhw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5048 rbghcebfhw.exe 5048 rbghcebfhw.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe 3924 ynjvzgwqflwo.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1328 2940 2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe 80 PID 5048 wrote to memory of 3924 5048 rbghcebfhw.exe 82 PID 1328 wrote to memory of 2296 1328 p2xd3za7y9lyhmysua9y.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_1f55b93188c82d4eb8cd8b46f991e873_elex_redline-stealer_remcos_stealc_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\jdstjatyiq\p2xd3za7y9lyhmysua9y.exe"C:\jdstjatyiq\p2xd3za7y9lyhmysua9y.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\jdstjatyiq\rbghcebfhw.exe"C:\jdstjatyiq\rbghcebfhw.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2296
-
-
-
C:\jdstjatyiq\rbghcebfhw.exeC:\jdstjatyiq\rbghcebfhw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\jdstjatyiq\ynjvzgwqflwo.exesmcudvzx8a8b "c:\jdstjatyiq\rbghcebfhw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\jdstjatyiq\p2xd3za7y9lyhmysua9y.exe
- Size 323KB
- SHA256 880933def6a9930e93b2df9bfb5ff880aaf988a85423d65f565e2faaa2eca8d8
- MD5 1f55b93188c82d4eb8cd8b46f991e873
- SHA1 d36bdb297db4862e92646dd48ce9279dd11fd65f
- SHA512 263ec6b184424edbb3654a1ad7ef5ee2960f282f9872b018247bb2a762f196579627db43597da9e80b1a9f8808ba662322170e402b476d25c9202dd0e82400f0
- SSDEEP 6144:/0kHUZNuWudtvkaDmEj11isvh/+LsFfNNBfNkhzSh:/rU+tcEjiO6sLNB4zS
- TLSH T166649E18F9D0C076C49270B2856AD7F299F9B8B01F65B6CBBBC805784F786D1663270E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\jdstjatyiq\qxljiertofah
- Size 11B
- SHA256 4cfe53dce4fa1e9aae2e0c72297ebce85b57ba880ac736a0263e7500e496d31c
- MD5 252d173d7e992e225029cba1d5e08f24
- SHA1 2bd8507c60eea24713b4183ac81aafc4f31b6ac2
- SHA512 0fa7839fd1ebf306fe49710db2d3a05e534a882d73ff9133d4fb24f308d8989c6d80296daa7c705618a871fb8e9779055831dff28934c6b4cad19c96f4b745fb
- MD5 SHA1 SHA512
- Path C:\jdstjatyiq\tckqx6
- Size 4B
- SHA256 91a4612e9a03014e8fcf099f014e45592055a13f3d10d80f362b4b4dc93280dd
- MD5 880ca78b347be38c1ddf628b7cc72867
- SHA1 3a6567f5980659d46fa227fce1326c274a4950d6
- SHA512 e14b34124e4c86052caeb272c7d83b7fff6e1b51ba45f4089d2c2831ae379d5695562c05ab2d04dd76aff2fc1f21f3e21a6d06640b5510a2ebce008893fa25f7
- MD5 SHA1 SHA512