1e5cc49d5fbbf1bb156b2ed142bc3e8621f94cd147c4ddbe64ae04f486be53c8

General

Target
2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.2MB
Sample260808-ha76basame
SHA256 1e5cc49d5fbbf1bb156b2ed142bc3e8621f94cd147c4ddbe64ae04f486be53c8
MD5 5592e3ddb9efec7ae6bd83c0cb05dfd9
SHA1 b4e62e950b7b7e4882f61f9ca9ca7ad347dad321
SHA512 d2c89c89234ebc53d843f6466f9a63c8103eb42a88731d67808c8639fd0ea558ecb2c01dae7286e55a1bfe31a9cae3851801080242748e8809246e90dc65bca0
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgIYA+w+y4e:z6F0eMpAAYEhpBhwx4e
TLSH
T164456C94E783C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF15BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2592	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2592	5112	2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5592e3ddb9efec7ae6bd83c0cb05dfd9_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXD2BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXD2BB.tmp
Size 1.2MB
SHA256 2bbca52b8904d84e503b2e9bd403b8785995654c7ff6111cb4694e22ca4b2afd
MD5 3b45f0f35b28f80eb964c801fb5801be
SHA1 2cbfa9dd4a12f1bb6ea124b7cc8d7a115b80299f
SHA512 8aafa136a495971248ad0a8941c2d73c916077a90843da605a9c8bce0d9c7f56079dd07d0836bf39177f73544ce70d3b287e4b046ae6075adcd4d8aa19cc591b
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOLIYA+wX2:36F0eMpAAYEhp2hwm
TLSH
T1E4456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 64KB
SHA256 5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160
MD5 e97c622b03fb2a2598bf019fbbe29f2c
SHA1 32698bd1d3a0ff6cf441770d1b2b816285068d19
SHA512 db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d
SSDEEP 768:nMgEYaPKRsVvd7M826QXqVXDjPXHyRhQcBU+zGqJS967GMctEvdGA9SYxQ:Mg/6/tM8NXDjPX0QWlfGMckTQ
TLSH
T1C7536B21B981C073C4465079482DC7B19F7BBC3126B5C987BB961BBB9F313D1A72B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 3d2308a8796d7ef78a5014478185283d97206fe6047dc909d259bdbf67834f19
MD5 02c2f023ef39158f7d6cacb8de104b31
SHA1 31a23defb4cb72e9557bfa4b3086462dc044527f
SHA512 355af6f437661b1b6e0c4565663c2b9a5b65dd4c7a349998cb5253ad100f632ebe1e820317be42de7ee493dd3951f6aea139c1f89b7c7ce6e96590cb73b39299
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgIYA+w+y:z6F0eMpAAYEhpBhwx
TLSH
T1B7456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 19cb6bf407bb098280ab2ec3aff021431f0e87e987cc1f90770ed0f37ebe3920
MD5 6347549e49940057debaab48ed6959e7
SHA1 c35ba75a4721fd3c4b3a5853c9737e585f5ac620
SHA512 76cc8868f93bf5e3728151af8c7dc229898dedc2e63280e4e5d9f843862dd11118603741b2a71dd8dcee5caa45ebca1c4621cbb9b937be8625f405d32ced95e4
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOKIYA+wip:b6F0eMpAAYEhp7hwm
TLSH
T182456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 504e6c3534718a87cd4ac23c7fe2df8181026e8c6b6d4ed9a825f83a820cfdbc
MD5 c932a36b2ac8b6102f729164a7be897e
SHA1 c3ceaf79ff7fcc9a030d9678358f689e92aaffcd
SHA512 1c04907334b1b2876ad18524348a4efd2e09decf777fe005eae7a4d6b717cfb3414174ff02ed9ea0aac2768142afe76c14414fefe69d3e3fc01c1f10f96a2807
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOXIYA+wSH:z6F0eMpAAYEhpKhws
TLSH
T19D456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 3b85077016bc5fa034f87457eb6ab32e99963276c64def705b59939c37c1ba62
MD5 fe9369d230c366aabdb4709c0b869886
SHA1 599704d42475bdf19d81992baf60fa47f9e566cf
SHA512 3c50fd3cb7257a433cff8aff1ff9887b4cecf6cb4c333f3cd178f6c995aef092fc9f68e6d93f54b2e6a6f1216fe041becd4330fe692dc22c9a5398ca5681527b
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOiIYA+wXO:H6F0eMpAAYEhpbhw+
TLSH
T1B8456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 18c4eb39af740c032e86ea09d6f009443d88655077720a504b15265204f87c3e
MD5 39adc26627101ad2f91486e5281684d0
SHA1 9cc6ca8aa449ad329d422ee64f843d67d243a187
SHA512 62c7ca056d88b99ef6a1e3e3758073501eb38150a74bbd79cdc76f72d3e1255f5f9f5fc971e693b0b72f333df65f99c89a4159b4f44b5d5ae38313923639fb13
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8IYA+wd2:/6F0eMpAAYEhpBhwQ
TLSH
T1FE456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5112-155-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads