Analysis
- max time kernel
147s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 07:07
General
- Target 2026-07-18_9083bd3a73670afc2540029ced9572dc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 766KB
- Sample260718-hxtlfae17x
- SHA256 6d7827c10e4e0ca1964f90400a3ef02b0084215986e14ac4d4bbb89d15332ccf
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 29 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_9083bd3a73670afc2540029ced9572dc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_9083bd3a73670afc2540029ced9572dc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 924 1752 1760 908 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 924 2824 2944 908 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 924 2824 2944 908 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 924 1752 1760 908 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
MsSense.exe
NisSrv.exe
wmpnetwk.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/672-254-0x00007FF683510000-0x00007FF68384E000-memory.dmp
memory/672-224-0x00000235C3DB0000-0x00000235C3E16000-memory.dmp
memory/672-223-0x00007FF683510000-0x00007FF68384E000-memory.dmp
memory/856-193-0x0000027BBC9B0000-0x0000027BBCA16000-memory.dmp
memory/856-244-0x00007FF68DD20000-0x00007FF68E1F0000-memory.dmp
memory/856-192-0x0000027BBC9B0000-0x0000027BBCA16000-memory.dmp
memory/856-191-0x00007FF68DD20000-0x00007FF68E1F0000-memory.dmp
memory/1476-104-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/1476-105-0x0000000000900000-0x0000000000969000-memory.dmp
memory/1476-111-0x0000000000900000-0x0000000000969000-memory.dmp
memory/1476-182-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/1908-220-0x00007FF7D3C30000-0x00007FF7D3ED2000-memory.dmp
memory/1908-155-0x0000023E2CC70000-0x0000023E2CCD6000-memory.dmp
memory/1908-154-0x0000023E2CC70000-0x0000023E2CCD6000-memory.dmp
memory/1908-152-0x00007FF7D3C30000-0x00007FF7D3ED2000-memory.dmp
memory/2032-179-0x00007FF75A1E0000-0x00007FF75A500000-memory.dmp
memory/2032-172-0x000001ECCB7B0000-0x000001ECCB816000-memory.dmp
memory/2032-171-0x00007FF75A1E0000-0x00007FF75A500000-memory.dmp
memory/2032-177-0x000001ECCB7B0000-0x000001ECCB816000-memory.dmp
memory/2032-173-0x000001ECCB7B0000-0x000001ECCB816000-memory.dmp
memory/2072-88-0x000001C7B4A90000-0x000001C7B4AF6000-memory.dmp
memory/2072-86-0x000001C7B4830000-0x000001C7B4954000-memory.dmp
memory/2072-87-0x000001C7B4A90000-0x000001C7B4AF6000-memory.dmp
memory/2088-251-0x00007FF702EB0000-0x00007FF702FDE000-memory.dmp
memory/2088-212-0x00007FF702EB0000-0x00007FF702FDE000-memory.dmp
memory/2088-213-0x0000024A25480000-0x0000024A254E6000-memory.dmp
memory/2088-214-0x0000024A25480000-0x0000024A254E6000-memory.dmp
memory/2284-222-0x00007FF7C2850000-0x00007FF7C29E4000-memory.dmp
memory/2284-162-0x00007FF7C2850000-0x00007FF7C29E4000-memory.dmp
memory/2284-163-0x0000025DBC720000-0x0000025DBC786000-memory.dmp
memory/2284-164-0x0000025DBC720000-0x0000025DBC786000-memory.dmp
memory/2320-320-0x000001B7A6000000-0x000001B7A61CA000-memory.dmp
memory/2388-53-0x000002DCCCD80000-0x000002DCCCEA4000-memory.dmp
memory/2388-54-0x000002DCCE000000-0x000002DCCE066000-memory.dmp
memory/2388-55-0x000002DCCE000000-0x000002DCCE066000-memory.dmp
memory/2524-28-0x000002CE609D0000-0x000002CE60A36000-memory.dmp
memory/2524-27-0x000002CE609D0000-0x000002CE60A36000-memory.dmp
memory/2524-103-0x00007FF6DEC60000-0x00007FF6DED28000-memory.dmp
memory/2524-26-0x00007FF6DEC60000-0x00007FF6DED28000-memory.dmp
memory/2524-29-0x000002CE609D0000-0x000002CE60A36000-memory.dmp
memory/2696-135-0x0000023DED0E0000-0x0000023DED146000-memory.dmp
memory/2696-134-0x00007FF67FF30000-0x00007FF680346000-memory.dmp
memory/2696-226-0x0000023DED0E0000-0x0000023DED146000-memory.dmp
memory/2696-207-0x00007FF67FF30000-0x00007FF680346000-memory.dmp
memory/2696-136-0x0000023DED0E0000-0x0000023DED146000-memory.dmp
memory/2696-228-0x00007FF67FF30000-0x00007FF680346000-memory.dmp
memory/2900-229-0x00007FF61DF10000-0x00007FF61E19A000-memory.dmp
memory/2900-184-0x000001780F530000-0x000001780F596000-memory.dmp
memory/2900-185-0x000001780F530000-0x000001780F596000-memory.dmp
memory/2900-183-0x00007FF61DF10000-0x00007FF61E19A000-memory.dmp
memory/3356-143-0x00007FF7C05D0000-0x00007FF7C0683000-memory.dmp
memory/3356-145-0x00000258630F0000-0x0000025863156000-memory.dmp
memory/3356-144-0x00000258630F0000-0x0000025863156000-memory.dmp
memory/3356-211-0x00007FF7C05D0000-0x00007FF7C0683000-memory.dmp
memory/4216-170-0x00007FF7AB280000-0x00007FF7AB3C9000-memory.dmp
memory/4216-96-0x0000021A9BBB0000-0x0000021A9BC16000-memory.dmp
memory/4216-97-0x0000021A9BBB0000-0x0000021A9BC16000-memory.dmp
memory/4216-94-0x00007FF7AB280000-0x00007FF7AB3C9000-memory.dmp
memory/4264-200-0x00007FF6F3E50000-0x00007FF6F3EFD000-memory.dmp
memory/4264-125-0x00007FF6F3E50000-0x00007FF6F3EFD000-memory.dmp
memory/4264-127-0x000001FDB3770000-0x000001FDB37D6000-memory.dmp
memory/4264-126-0x000001FDB3770000-0x000001FDB37D6000-memory.dmp
memory/4608-116-0x00007FF6DEC60000-0x00007FF6DED28000-memory.dmp
memory/4608-36-0x0000013BBFF60000-0x0000013BBFFC6000-memory.dmp
memory/4608-38-0x0000013BBFF60000-0x0000013BBFFC6000-memory.dmp
memory/4608-37-0x0000013BBFF60000-0x0000013BBFFC6000-memory.dmp
memory/4608-35-0x00007FF6DEC60000-0x00007FF6DED28000-memory.dmp
memory/4824-74-0x00007FF6782F0000-0x00007FF678409000-memory.dmp
memory/4824-161-0x00007FF6782F0000-0x00007FF678409000-memory.dmp
memory/4824-76-0x000001E654090000-0x000001E6540F6000-memory.dmp
memory/4824-75-0x000001E654090000-0x000001E6540F6000-memory.dmp
memory/4836-6-0x0000000003030000-0x0000000003099000-memory.dmp
memory/4836-234-0x00000000009E0000-0x0000000000B0B000-memory.dmp
memory/4836-1-0x0000000003030000-0x0000000003099000-memory.dmp
memory/4836-0-0x00000000009E0000-0x0000000000B0B000-memory.dmp
memory/4836-42-0x00000000009E0000-0x0000000000B0B000-memory.dmp
memory/4836-7-0x0000000003030000-0x0000000003099000-memory.dmp
memory/4900-16-0x0000020FE8510000-0x0000020FE8576000-memory.dmp
memory/4900-17-0x0000020FE8510000-0x0000020FE8576000-memory.dmp
memory/4900-73-0x00007FF7DF1B0000-0x00007FF7DF2D2000-memory.dmp
memory/4900-15-0x00007FF7DF1B0000-0x00007FF7DF2D2000-memory.dmp
memory/4900-18-0x0000020FE8510000-0x0000020FE8576000-memory.dmp
memory/5428-203-0x0000029A26890000-0x0000029A268F6000-memory.dmp
memory/5428-202-0x0000029A26890000-0x0000029A268F6000-memory.dmp
memory/5428-248-0x00007FF6C0160000-0x00007FF6C0666000-memory.dmp
memory/5428-201-0x00007FF6C0160000-0x00007FF6C0666000-memory.dmp
memory/5896-71-0x00007FF7672A0000-0x00007FF767407000-memory.dmp
memory/5896-62-0x000002763FED0000-0x000002763FF36000-memory.dmp
memory/5896-63-0x000002763FED0000-0x000002763FF36000-memory.dmp
memory/5896-69-0x000002763FED0000-0x000002763FF36000-memory.dmp
memory/5896-61-0x00007FF7672A0000-0x00007FF767407000-memory.dmp
memory/5940-197-0x00007FF7049B0000-0x00007FF7050F3000-memory.dmp
memory/5940-118-0x00000234C1F40000-0x00000234C1FA6000-memory.dmp
memory/5940-122-0x00007FF7049B0000-0x00007FF7050F3000-memory.dmp
memory/5940-117-0x00000234C1F40000-0x00000234C1FA6000-memory.dmp
memory/5940-255-0x00000234C1F40000-0x00000234C1FA6000-memory.dmp
memory/5940-258-0x00007FF7049B0000-0x00007FF7050F3000-memory.dmp
memory/6016-46-0x0000023A0B710000-0x0000023A0B776000-memory.dmp
memory/6016-45-0x0000023A0BBF0000-0x0000023A0BD14000-memory.dmp
memory/6016-47-0x0000023A0B710000-0x0000023A0B776000-memory.dmp