Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
11/07/2026, 04:32
General
- Target 2026-07-11_67923fd54fba8ebb5cdbc770d6dcc057_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 770KB
- Sample260711-e6a9nsdy7v
- SHA256 ed1a47e2b61192489c5ba6985c6dd08cc1748c816e0b65b3ce95f737bb01922b
Malware Config
Signatures
- Executes dropped EXE 17 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 23 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_67923fd54fba8ebb5cdbc770d6dcc057_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_67923fd54fba8ebb5cdbc770d6dcc057_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
MsSense.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
alg.exe
msdtc.exe
snmptrap.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/108-89-0x000001B81B140000-0x000001B81B1A6000-memory.dmp
memory/108-87-0x000001B81AEB0000-0x000001B81AFB8000-memory.dmp
memory/108-88-0x000001B81B140000-0x000001B81B1A6000-memory.dmp
memory/1284-157-0x00000210D8B90000-0x00000210D8BF6000-memory.dmp
memory/1284-158-0x00000210D8B90000-0x00000210D8BF6000-memory.dmp
memory/1284-156-0x00007FF6F80E0000-0x00007FF6F8383000-memory.dmp
memory/1284-203-0x00007FF6F80E0000-0x00007FF6F8383000-memory.dmp
memory/1380-35-0x00007FF6978B0000-0x00007FF697979000-memory.dmp
memory/1380-36-0x0000020C9F530000-0x0000020C9F596000-memory.dmp
memory/1380-93-0x00007FF6978B0000-0x00007FF697979000-memory.dmp
memory/1380-39-0x0000020C9F530000-0x0000020C9F596000-memory.dmp
memory/1380-38-0x0000020C9F530000-0x0000020C9F596000-memory.dmp
memory/1716-200-0x00007FF625F40000-0x00007FF626357000-memory.dmp
memory/1716-196-0x00007FF625F40000-0x00007FF626357000-memory.dmp
memory/1716-135-0x00000188D3BD0000-0x00000188D3C36000-memory.dmp
memory/1716-137-0x00007FF625F40000-0x00007FF626357000-memory.dmp
memory/1716-136-0x00000188D3BD0000-0x00000188D3C36000-memory.dmp
memory/1716-198-0x00000188D3BD0000-0x00000188D3C36000-memory.dmp
memory/1876-65-0x000001B56AB30000-0x000001B56AB96000-memory.dmp
memory/1876-64-0x000001B56AB30000-0x000001B56AB96000-memory.dmp
memory/1876-72-0x00007FF7CC900000-0x00007FF7CCA68000-memory.dmp
memory/1876-70-0x000001B56AB30000-0x000001B56AB96000-memory.dmp
memory/1876-63-0x00007FF7CC900000-0x00007FF7CCA68000-memory.dmp
memory/2144-191-0x00007FF7697A0000-0x00007FF769EE4000-memory.dmp
memory/2144-207-0x000001BF5A680000-0x000001BF5A6E6000-memory.dmp
memory/2144-119-0x00007FF7697A0000-0x00007FF769EE4000-memory.dmp
memory/2144-118-0x000001BF5A680000-0x000001BF5A6E6000-memory.dmp
memory/2144-209-0x00007FF7697A0000-0x00007FF769EE4000-memory.dmp
memory/2144-117-0x000001BF5A680000-0x000001BF5A6E6000-memory.dmp
memory/2896-105-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/2896-111-0x0000000000910000-0x0000000000979000-memory.dmp
memory/2896-106-0x0000000000910000-0x0000000000979000-memory.dmp
memory/2896-155-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/2944-204-0x00007FF736390000-0x00007FF736525000-memory.dmp
memory/2944-166-0x0000022873D50000-0x0000022873DB6000-memory.dmp
memory/2944-165-0x0000022873D50000-0x0000022873DB6000-memory.dmp
memory/2944-164-0x00007FF736390000-0x00007FF736525000-memory.dmp
memory/2996-47-0x000001DAA9900000-0x000001DAA9966000-memory.dmp
memory/2996-46-0x000001DAA9900000-0x000001DAA9966000-memory.dmp
memory/2996-45-0x000001DAA9980000-0x000001DAA9A88000-memory.dmp
memory/3176-75-0x00007FF710800000-0x00007FF71091A000-memory.dmp
memory/3176-76-0x0000019D479D0000-0x0000019D47A36000-memory.dmp
memory/3176-77-0x0000019D479D0000-0x0000019D47A36000-memory.dmp
memory/3176-132-0x00007FF710800000-0x00007FF71091A000-memory.dmp
memory/3284-29-0x0000026015810000-0x0000026015876000-memory.dmp
memory/3284-62-0x00007FF6978B0000-0x00007FF697979000-memory.dmp
memory/3284-26-0x00007FF6978B0000-0x00007FF697979000-memory.dmp
memory/3284-27-0x0000026015810000-0x0000026015876000-memory.dmp
memory/3436-6-0x0000000002D20000-0x0000000002D89000-memory.dmp
memory/3436-37-0x00000000005A0000-0x00000000006CC000-memory.dmp
memory/3436-7-0x0000000002D20000-0x0000000002D89000-memory.dmp
memory/3436-0-0x00000000005A0000-0x00000000006CC000-memory.dmp
memory/3436-2-0x0000000002D20000-0x0000000002D89000-memory.dmp
memory/3436-173-0x00000000005A0000-0x00000000006CC000-memory.dmp
memory/3600-125-0x00007FF69D510000-0x00007FF69D5BE000-memory.dmp
memory/3600-192-0x00007FF69D510000-0x00007FF69D5BE000-memory.dmp
memory/3600-127-0x000001502BAF0000-0x000001502BB56000-memory.dmp
memory/3600-126-0x000001502BAF0000-0x000001502BB56000-memory.dmp
memory/4184-18-0x00000213E3480000-0x00000213E34E6000-memory.dmp
memory/4184-51-0x00007FF782740000-0x00007FF782863000-memory.dmp
memory/4184-17-0x00000213E3480000-0x00000213E34E6000-memory.dmp
memory/4184-16-0x00000213E3480000-0x00000213E34E6000-memory.dmp
memory/4184-15-0x00007FF782740000-0x00007FF782863000-memory.dmp
memory/4508-189-0x00007FF722D00000-0x00007FF723021000-memory.dmp
memory/4508-181-0x00000280784A0000-0x0000028078506000-memory.dmp
memory/4508-182-0x00000280784A0000-0x0000028078506000-memory.dmp
memory/4508-186-0x00007FF722D00000-0x00007FF723021000-memory.dmp
memory/4508-187-0x00000280784A0000-0x0000028078506000-memory.dmp
memory/5440-96-0x00007FF6E40C0000-0x00007FF6E420A000-memory.dmp
memory/5440-98-0x000001F20A560000-0x000001F20A5C6000-memory.dmp
memory/5440-99-0x000001F20A560000-0x000001F20A5C6000-memory.dmp
memory/5440-145-0x00007FF6E40C0000-0x00007FF6E420A000-memory.dmp
memory/5536-147-0x0000028EF94E0000-0x0000028EF9546000-memory.dmp
memory/5536-202-0x00007FF6F8600000-0x00007FF6F86B4000-memory.dmp
memory/5536-148-0x0000028EF94E0000-0x0000028EF9546000-memory.dmp
memory/5536-146-0x00007FF6F8600000-0x00007FF6F86B4000-memory.dmp
memory/5652-55-0x000001CAADA90000-0x000001CAADAF6000-memory.dmp
memory/5652-56-0x000001CAADA90000-0x000001CAADAF6000-memory.dmp
memory/5652-54-0x000001CAAD860000-0x000001CAAD968000-memory.dmp