723315fa0aef87b9586e5bce0ca7901450d848e63a8e29dd282310d523b5b5bf

General

Target
2026-08-22_a2cda10198b1b60d0435e91a0a241d92_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.2MB
Sample260823-d3bklaxtbw
SHA256 723315fa0aef87b9586e5bce0ca7901450d848e63a8e29dd282310d523b5b5bf
MD5 a2cda10198b1b60d0435e91a0a241d92
SHA1 9b947e2e7ae9390c98db261e0f8992d7f9ab3320
SHA512 faf20551c1534e44e4c8fdfe4c39aa50d3cb5f7b492be524597440eda035a48645a01e83b6d25b0f344081a744ed6e483eb2678f29247e75545b7067b44fcc28
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsWYA+w2+4O:w6F0eMpAAYEhptPhwd4O
TLSH
T1C0456C54E783C4F5F92314F1444FE7FBA5309E2940318D6BFBC8EF11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3536	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_a2cda10198b1b60d0435e91a0a241d92_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3536	1564	2026-08-22_a2cda10198b1b60d0435e91a0a241d92_elex_redline-stealer_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a2cda10198b1b60d0435e91a0a241d92_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a2cda10198b1b60d0435e91a0a241d92_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 66e4591b65ed5590cd90b3830ec53b995f203528a4119331c0c05b969d09e392
MD5 9ac381a90922c1602ee4218c9570ed2d
SHA1 f69655d567fd400a07921da555f2f8c8e5fc958c
SHA512 402d53f0f4a37aa12e86be3c863784ad9b7636383833340ee358d1122840f3ec4d394e474e08fb849baf7dc4eb04de241e4a9109da088caa3a1ea446574ed36a
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9qf/Rs47WXnueVulvspdb3:46F0eMpAAYEhpkqn37WXnu6ulvKdfLME
TLSH
T164F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4DBC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4DBC.tmp
Size 1.2MB
SHA256 8dc7dabe149802b30aae878451cd621c761ddc7ed552c8bcb7822d0ade3f764b
MD5 e655cc03254b241e86b565efe6467409
SHA1 eafab15c6bb53cd527cfe705863c2469173edfa9
SHA512 1174c4932b5a2dafec8910d07fd133864dacce632955257f601203a3729a07050ea7265b44a83a383d7aa1ae14abbb6d056a238080b08df8736bb8afd3b1fdc2
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOWYA+wTm:c6F0eMpAAYEhp7Phw6
TLSH
T1E7455C54E783C4F5FD2314F1444FE7FBA5309E1980318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 64KB
SHA256 5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160
MD5 e97c622b03fb2a2598bf019fbbe29f2c
SHA1 32698bd1d3a0ff6cf441770d1b2b816285068d19
SHA512 db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d
SSDEEP 768:nMgEYaPKRsVvd7M826QXqVXDjPXHyRhQcBU+zGqJS967GMctEvdGA9SYxQ:Mg/6/tM8NXDjPX0QWlfGMckTQ
TLSH
T1C7536B21B981C073C4465079482DC7B19F7BBC3126B5C987BB961BBB9F313D1A72B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 768b726083f780a87ac9f7c9f12194f3adba64053b9c7b8b4e8b308f4d760ae7
MD5 995a31db6c9eba522ecb6f628707282c
SHA1 e949f9f2853641066f71c69de96d0ea1a2d5e498
SHA512 65c1c4ace066efba48b53c2c9bd55e7f1ffc3f46ceab5924ce109b825bf944630e17252966773642ac6863c67459d2c9e1228531af3bff2ed77c61e8e73c94cf
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsWYA+w2+:w6F0eMpAAYEhptPhwd
TLSH
T1CC455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 50cdb38a79774f604e4be4792e9022c5a83e3afe6b83059ac9c463313a7c48eb
MD5 9d2e4aa04ba7dbc94d076da15bdf084c
SHA1 e0044fb5b1b1cf3d6cbe7c464f5c06382d4b841a
SHA512 7a368938800857751fdc25a02dfe36d69ce1615707be719a8583d9c35f0f940f78608545411b10f03bfd5cbaa5f9d3900bde67ad181299f2262c921eaadb53be
SSDEEP 24576:lt7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIWYA+wq9:Y6F0eMpAAYEhp9Phwq
TLSH
T1B2455C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 9c85e8719a44de475b3600db041e2cd0c5c66a6854869e182ba329e063c8cb4d
MD5 8dbd41a418dfcd9a564ad8bbebb8c2a2
SHA1 f45d4d487a13e11b946911636dbf4425596ae681
SHA512 8c9b24af7037da13030ba3fe6f662af13989ce86a78c44e8443d127a63c07ac0053224ccf6414c02113779a4fb2dd2baeb0a84542eaa1ab7d9f059f42f425465
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyWYA+wNy:w6F0eMpAAYEhpjPhws
TLSH
T140455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-153-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads