1e5cc49d5fbbf1bb156b2ed142bc3e8621f94cd147c4ddbe64ae04f486be53c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.2MB
Sample260808-ha76basame
SHA256 1e5cc49d5fbbf1bb156b2ed142bc3e8621f94cd147c4ddbe64ae04f486be53c8
MD5 5592e3ddb9efec7ae6bd83c0cb05dfd9
SHA1 b4e62e950b7b7e4882f61f9ca9ca7ad347dad321
SHA512 d2c89c89234ebc53d843f6466f9a63c8103eb42a88731d67808c8639fd0ea558ecb2c01dae7286e55a1bfe31a9cae3851801080242748e8809246e90dc65bca0
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgIYA+w+y4e:z6F0eMpAAYEhpBhwx4e
TLSH
T164456C94E783C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF15BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4264	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4264	1128	2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX582D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX582D.tmp
Size 1.2MB
SHA256 3d2308a8796d7ef78a5014478185283d97206fe6047dc909d259bdbf67834f19
MD5 02c2f023ef39158f7d6cacb8de104b31
SHA1 31a23defb4cb72e9557bfa4b3086462dc044527f
SHA512 355af6f437661b1b6e0c4565663c2b9a5b65dd4c7a349998cb5253ad100f632ebe1e820317be42de7ee493dd3951f6aea139c1f89b7c7ce6e96590cb73b39299
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgIYA+w+y:z6F0eMpAAYEhpBhwx
TLSH
T1B7456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5B6F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5B6F.tmp
Size 1.2MB
SHA256 1482bb82e584e85b3693a0a2e035e6314931646dc2d2fb2281c5b1203b4a2a3b
MD5 1ddce3504f89dc7739b1678332380bb6
SHA1 4be505723165187c01e33ae6ea9ba05a0a4403b5
SHA512 090d3919884631f9d5465eb63263c82ca7ae795e47bc04243c5d24e791ef15947d868ec09418e3375adf63498cf94ab2c701a94fd283694e828eb2a2ab722ff3
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyIYA+w+K:P6F0eMpAAYEhp/hwJ
TLSH
T11F456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 64KB
SHA256 5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160
MD5 e97c622b03fb2a2598bf019fbbe29f2c
SHA1 32698bd1d3a0ff6cf441770d1b2b816285068d19
SHA512 db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d
SSDEEP 768:nMgEYaPKRsVvd7M826QXqVXDjPXHyRhQcBU+zGqJS967GMctEvdGA9SYxQ:Mg/6/tM8NXDjPX0QWlfGMckTQ
TLSH
T1C7536B21B981C073C4465079482DC7B19F7BBC3126B5C987BB961BBB9F313D1A72B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 3b85077016bc5fa034f87457eb6ab32e99963276c64def705b59939c37c1ba62
MD5 fe9369d230c366aabdb4709c0b869886
SHA1 599704d42475bdf19d81992baf60fa47f9e566cf
SHA512 3c50fd3cb7257a433cff8aff1ff9887b4cecf6cb4c333f3cd178f6c995aef092fc9f68e6d93f54b2e6a6f1216fe041becd4330fe692dc22c9a5398ca5681527b
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOiIYA+wXO:H6F0eMpAAYEhpbhw+
TLSH
T1B8456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-274-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads