Analysis
- max time kernel
148s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 02:56
General
- Target 2026-08-08_ad18256ef74339a8aa56b315b0538697_elex_redline-stealer_rhadamanthys_stealc_stop.exe
- Size 667KB
- Sample260808-dfghbs1zcw
- SHA256 dfeca842c5e91ba236cae27d6e4e4ddadfdc2d8e5c8fb41e85f16bb2a39e5243
Malware Config
Signatures
- Executes dropped EXE 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_ad18256ef74339a8aa56b315b0538697_elex_redline-stealer_rhadamanthys_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ad18256ef74339a8aa56b315b0538697_elex_redline-stealer_rhadamanthys_stealc_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/492-37-0x000001CD0B620000-0x000001CD0B740000-memory.dmp
memory/492-40-0x000001CD0B860000-0x000001CD0B8C6000-memory.dmp
memory/492-39-0x000001CD0B860000-0x000001CD0B8C6000-memory.dmp
memory/492-38-0x000001CD0B860000-0x000001CD0B8C6000-memory.dmp
memory/904-367-0x00007FF6E5B80000-0x00007FF6E6051000-memory.dmp
memory/904-361-0x000002365BE80000-0x000002365BEE6000-memory.dmp
memory/904-363-0x000002365BE80000-0x000002365BEE6000-memory.dmp
memory/1668-29-0x00000159E9740000-0x00000159E97A6000-memory.dmp
memory/1668-30-0x00000159E9740000-0x00000159E97A6000-memory.dmp
memory/1668-31-0x00000159E9740000-0x00000159E97A6000-memory.dmp
memory/1668-28-0x00000159E9620000-0x00000159E9740000-memory.dmp
memory/1676-295-0x000001D2BB430000-0x000001D2BB496000-memory.dmp
memory/1676-369-0x00007FF66B980000-0x00007FF66BA2E000-memory.dmp
memory/1676-294-0x000001D2BB430000-0x000001D2BB496000-memory.dmp
memory/1676-293-0x00007FF66B980000-0x00007FF66BA2E000-memory.dmp
memory/2204-333-0x000001416DD50000-0x000001416DDB6000-memory.dmp
memory/2204-334-0x000001416DD50000-0x000001416DDB6000-memory.dmp
memory/2204-332-0x00007FF70A3B0000-0x00007FF70A545000-memory.dmp
memory/2268-15-0x00007FF7AD6E0000-0x00007FF7AD803000-memory.dmp
memory/2268-18-0x0000022B8FB70000-0x0000022B8FBD6000-memory.dmp
memory/2268-64-0x00007FF7AD6E0000-0x00007FF7AD803000-memory.dmp
memory/2268-17-0x0000022B8FB70000-0x0000022B8FBD6000-memory.dmp
memory/2268-16-0x0000022B8FB70000-0x0000022B8FBD6000-memory.dmp
memory/2704-6-0x0000000002920000-0x0000000002AA7000-memory.dmp
memory/2704-7-0x0000000002C20000-0x0000000002C89000-memory.dmp
memory/2704-0-0x0000000002C20000-0x0000000002C89000-memory.dmp
memory/2948-384-0x0000024EAD850000-0x0000024EAD8B6000-memory.dmp
memory/2948-383-0x0000024EAD850000-0x0000024EAD8B6000-memory.dmp
memory/2948-382-0x00007FF6D8800000-0x00007FF6D892F000-memory.dmp
memory/3744-303-0x00007FF619350000-0x00007FF619767000-memory.dmp
memory/3744-377-0x00007FF619350000-0x00007FF619767000-memory.dmp
memory/3744-302-0x0000022A950E0000-0x0000022A95146000-memory.dmp
memory/3744-304-0x0000022A950E0000-0x0000022A95146000-memory.dmp
memory/3788-354-0x000001CC6E760000-0x000001CC6E7C6000-memory.dmp
memory/3788-353-0x00007FF699620000-0x00007FF6998AB000-memory.dmp
memory/3788-355-0x000001CC6E760000-0x000001CC6E7C6000-memory.dmp
memory/4120-371-0x00007FF7072F0000-0x00007FF7077F7000-memory.dmp
memory/4120-373-0x0000021452830000-0x0000021452896000-memory.dmp
memory/4120-372-0x0000021452830000-0x0000021452896000-memory.dmp
memory/4316-312-0x00007FF7633E0000-0x00007FF7634A9000-memory.dmp
memory/4316-236-0x000001C867460000-0x000001C8674C6000-memory.dmp
memory/4316-237-0x000001C867460000-0x000001C8674C6000-memory.dmp
memory/4316-235-0x00007FF7633E0000-0x00007FF7634A9000-memory.dmp
memory/4716-279-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/4716-273-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4716-352-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4716-274-0x00000000009A0000-0x0000000000A09000-memory.dmp
memory/4812-323-0x00007FF729F90000-0x00007FF72A233000-memory.dmp
memory/4812-324-0x0000019EC7AE0000-0x0000019EC7B46000-memory.dmp
memory/4812-325-0x0000019EC7AE0000-0x0000019EC7B46000-memory.dmp
memory/4852-286-0x000001E4907D0000-0x000001E490836000-memory.dmp
memory/4852-288-0x000001E4907D0000-0x000001E490836000-memory.dmp
memory/4852-362-0x00007FF66BE40000-0x00007FF66C584000-memory.dmp
memory/4852-285-0x00007FF66BE40000-0x00007FF66C584000-memory.dmp
memory/4888-55-0x00007FF665CF0000-0x00007FF665E58000-memory.dmp
memory/4888-53-0x0000019EEFFA0000-0x0000019EF0006000-memory.dmp
memory/4888-46-0x00007FF665CF0000-0x00007FF665E58000-memory.dmp
memory/4888-47-0x0000019EEFFA0000-0x0000019EF0006000-memory.dmp
memory/4888-48-0x0000019EEFFA0000-0x0000019EF0006000-memory.dmp
memory/5496-315-0x000001E99C7A0000-0x000001E99C806000-memory.dmp
memory/5496-381-0x00007FF6A75B0000-0x00007FF6A7664000-memory.dmp
memory/5496-314-0x000001E99C7A0000-0x000001E99C806000-memory.dmp
memory/5496-313-0x00007FF6A75B0000-0x00007FF6A7664000-memory.dmp
memory/5632-331-0x00007FF6AFF60000-0x00007FF6B007A000-memory.dmp
memory/5632-253-0x0000024892F20000-0x0000024892F86000-memory.dmp
memory/5632-254-0x0000024892F20000-0x0000024892F86000-memory.dmp
memory/5632-252-0x00007FF6AFF60000-0x00007FF6B007A000-memory.dmp
memory/5736-245-0x00000284BFAD0000-0x00000284BFB36000-memory.dmp
memory/5736-244-0x00007FF7633E0000-0x00007FF7634A9000-memory.dmp
memory/5736-246-0x00000284BFAD0000-0x00000284BFB36000-memory.dmp
memory/5736-321-0x00007FF7633E0000-0x00007FF7634A9000-memory.dmp
memory/5876-60-0x000001EAB40C0000-0x000001EAB4126000-memory.dmp
memory/5876-58-0x000001EAB3ED0000-0x000001EAB3FF0000-memory.dmp
memory/5876-59-0x000001EAB40C0000-0x000001EAB4126000-memory.dmp
memory/6012-347-0x000002081FD70000-0x000002081FDD6000-memory.dmp
memory/6012-349-0x00007FF7B4B70000-0x00007FF7B4E91000-memory.dmp
memory/6012-343-0x000002081FD70000-0x000002081FDD6000-memory.dmp
memory/6012-342-0x000002081FD70000-0x000002081FDD6000-memory.dmp
memory/6012-341-0x00007FF7B4B70000-0x00007FF7B4E91000-memory.dmp
memory/6032-264-0x00007FF6716D0000-0x00007FF67181A000-memory.dmp
memory/6032-266-0x0000020C68200000-0x0000020C68266000-memory.dmp
memory/6032-267-0x0000020C68200000-0x0000020C68266000-memory.dmp
memory/6032-340-0x00007FF6716D0000-0x00007FF67181A000-memory.dmp