Analysis
- max time kernel
145s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 02:45
General
- Target 2026-08-05_d6ff0c4be53c790a7cd85d3e3bc9eb50_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 770KB
- Sample260805-c8631stygz
- SHA256 52285fa84e49cf00fea5d0547ca8b64c3e9d534ce7f29a830fa273398f48b6c7
Malware Config
Signatures
- Executes dropped EXE 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_d6ff0c4be53c790a7cd85d3e3bc9eb50_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_d6ff0c4be53c790a7cd85d3e3bc9eb50_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
appvcleaner.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/240-289-0x0000018ACB0A0000-0x0000018ACB106000-memory.dmp
memory/240-288-0x00007FF791280000-0x00007FF7919C4000-memory.dmp
memory/240-286-0x0000018ACB0A0000-0x0000018ACB106000-memory.dmp
memory/240-360-0x00007FF791280000-0x00007FF7919C4000-memory.dmp
memory/1152-316-0x0000027FC9D50000-0x0000027FC9DB6000-memory.dmp
memory/1152-315-0x0000027FC9D50000-0x0000027FC9DB6000-memory.dmp
memory/1152-379-0x00007FF7DFF60000-0x00007FF7E0014000-memory.dmp
memory/1152-314-0x00007FF7DFF60000-0x00007FF7E0014000-memory.dmp
memory/1184-349-0x00000195740C0000-0x0000019574126000-memory.dmp
memory/1184-345-0x00000195740C0000-0x0000019574126000-memory.dmp
memory/1184-344-0x00000195740C0000-0x0000019574126000-memory.dmp
memory/1184-343-0x00007FF63C020000-0x00007FF63C341000-memory.dmp
memory/1184-351-0x00007FF63C020000-0x00007FF63C341000-memory.dmp
memory/1196-396-0x00007FF7D9EE0000-0x00007FF7DA21F000-memory.dmp
memory/1196-397-0x000001F670F30000-0x000001F670F96000-memory.dmp
memory/1196-398-0x000001F670F30000-0x000001F670F96000-memory.dmp
memory/1376-7-0x00000000024C0000-0x0000000002529000-memory.dmp
memory/1376-0-0x00000000009A0000-0x0000000000ACC000-memory.dmp
memory/1376-26-0x00000000009A0000-0x0000000000ACC000-memory.dmp
memory/1376-6-0x00000000024C0000-0x0000000002529000-memory.dmp
memory/1376-1-0x00000000024C0000-0x0000000002529000-memory.dmp
memory/1412-384-0x00007FF7E53E0000-0x00007FF7E5575000-memory.dmp
memory/1412-333-0x00007FF7E53E0000-0x00007FF7E5575000-memory.dmp
memory/1412-334-0x000002B41DE20000-0x000002B41DE86000-memory.dmp
memory/1412-335-0x000002B41DE20000-0x000002B41DE86000-memory.dmp
memory/1416-387-0x00000161302E0000-0x0000016130346000-memory.dmp
memory/1416-386-0x00000161302E0000-0x0000016130346000-memory.dmp
memory/1416-385-0x00007FF69AD50000-0x00007FF69AE7F000-memory.dmp
memory/1508-62-0x000002E09D6C0000-0x000002E09D726000-memory.dmp
memory/1508-60-0x000002E09D4E0000-0x000002E09D5EE000-memory.dmp
memory/1508-61-0x000002E09D6C0000-0x000002E09D726000-memory.dmp
memory/1636-268-0x000001B1B8280000-0x000001B1B82E6000-memory.dmp
memory/1636-339-0x00007FF6952F0000-0x00007FF69543A000-memory.dmp
memory/1636-265-0x00007FF6952F0000-0x00007FF69543A000-memory.dmp
memory/1636-267-0x000001B1B8280000-0x000001B1B82E6000-memory.dmp
memory/1768-296-0x0000022654430000-0x0000022654496000-memory.dmp
memory/1768-294-0x00007FF781620000-0x00007FF7816CE000-memory.dmp
memory/1768-363-0x00007FF781620000-0x00007FF7816CE000-memory.dmp
memory/1768-295-0x0000022654430000-0x0000022654496000-memory.dmp
memory/1784-365-0x0000012F92900000-0x0000012F92966000-memory.dmp
memory/1784-364-0x0000012F92900000-0x0000012F92966000-memory.dmp
memory/1784-366-0x00007FF603330000-0x00007FF603801000-memory.dmp
memory/2472-356-0x000002BDEF680000-0x000002BDEF6E6000-memory.dmp
memory/2472-355-0x000002BDEF680000-0x000002BDEF6E6000-memory.dmp
memory/2472-354-0x00007FF6057E0000-0x00007FF605A6B000-memory.dmp
memory/2472-414-0x00007FF6057E0000-0x00007FF605A6B000-memory.dmp
memory/2528-325-0x000001C07E2D0000-0x000001C07E336000-memory.dmp
memory/2528-326-0x000001C07E2D0000-0x000001C07E336000-memory.dmp
memory/2528-380-0x00007FF7A4880000-0x00007FF7A4B23000-memory.dmp
memory/2528-324-0x00007FF7A4880000-0x00007FF7A4B23000-memory.dmp
memory/2756-254-0x000001C518CC0000-0x000001C518D26000-memory.dmp
memory/2756-255-0x000001C518CC0000-0x000001C518D26000-memory.dmp
memory/2756-332-0x00007FF74FF20000-0x00007FF75003A000-memory.dmp
memory/2756-253-0x00007FF74FF20000-0x00007FF75003A000-memory.dmp
memory/3108-375-0x00007FF7FA230000-0x00007FF7FA737000-memory.dmp
memory/3108-373-0x000002C0D64C0000-0x000002C0D6526000-memory.dmp
memory/3108-374-0x000002C0D64C0000-0x000002C0D6526000-memory.dmp
memory/4320-57-0x00007FF769F50000-0x00007FF76A0B8000-memory.dmp
memory/4320-55-0x0000026D0EE70000-0x0000026D0EED6000-memory.dmp
memory/4320-50-0x0000026D0EE70000-0x0000026D0EED6000-memory.dmp
memory/4320-49-0x0000026D0EE70000-0x0000026D0EED6000-memory.dmp
memory/4320-48-0x00007FF769F50000-0x00007FF76A0B8000-memory.dmp
memory/4672-303-0x0000025DDDC80000-0x0000025DDDCE6000-memory.dmp
memory/4672-304-0x00007FF62DAD0000-0x00007FF62DEE7000-memory.dmp
memory/4672-305-0x0000025DDDC80000-0x0000025DDDCE6000-memory.dmp
memory/4672-399-0x00007FF62DAD0000-0x00007FF62DEE7000-memory.dmp
memory/4672-393-0x0000025DDDC80000-0x0000025DDDCE6000-memory.dmp
memory/4672-372-0x00007FF62DAD0000-0x00007FF62DEE7000-memory.dmp
memory/5048-342-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5048-275-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/5048-280-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/5048-274-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5144-30-0x000001F7B6A60000-0x000001F7B6AC6000-memory.dmp
memory/5144-32-0x000001F7B6A60000-0x000001F7B6AC6000-memory.dmp
memory/5144-29-0x000001F7B6880000-0x000001F7B698E000-memory.dmp
memory/5144-31-0x000001F7B6A60000-0x000001F7B6AC6000-memory.dmp
memory/5468-247-0x0000017157C40000-0x0000017157CA6000-memory.dmp
memory/5468-245-0x00007FF7C3F10000-0x00007FF7C3FD9000-memory.dmp
memory/5468-323-0x00007FF7C3F10000-0x00007FF7C3FD9000-memory.dmp
memory/5468-246-0x0000017157C40000-0x0000017157CA6000-memory.dmp
memory/5880-40-0x000002A9F5350000-0x000002A9F53B6000-memory.dmp
memory/5880-41-0x000002A9F5350000-0x000002A9F53B6000-memory.dmp
memory/5880-39-0x000002A9F5350000-0x000002A9F53B6000-memory.dmp
memory/5880-38-0x000002A9F5120000-0x000002A9F522E000-memory.dmp
memory/5908-17-0x00000223CE090000-0x00000223CE0F6000-memory.dmp
memory/5908-47-0x00007FF6480C0000-0x00007FF6481E3000-memory.dmp
memory/5908-18-0x00000223CE090000-0x00000223CE0F6000-memory.dmp
memory/5908-16-0x00000223CE090000-0x00000223CE0F6000-memory.dmp
memory/5908-15-0x00007FF6480C0000-0x00007FF6481E3000-memory.dmp
memory/5992-313-0x00007FF7C3F10000-0x00007FF7C3FD9000-memory.dmp
memory/5992-237-0x000002439D800000-0x000002439D866000-memory.dmp
memory/5992-238-0x000002439D800000-0x000002439D866000-memory.dmp
memory/5992-236-0x00007FF7C3F10000-0x00007FF7C3FD9000-memory.dmp