Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/08/2026, 20:11
General
- Target 2026-08-30_29f04e99cf8ddfda698d0307526f1937_elex_redline-stealer_rhadamanthys_stealc_stop.exe
- Size 667KB
- Sample260830-yyj2dsyeqf
- SHA256 b8e324ebf71a5a9cd84ee60c44e90b30f0e1fbe7b0259c5dac067535392e48be
Malware Config
Signatures
- Executes dropped EXE 9 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 10 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_29f04e99cf8ddfda698d0307526f1937_elex_redline-stealer_rhadamanthys_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_29f04e99cf8ddfda698d0307526f1937_elex_redline-stealer_rhadamanthys_stealc_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
GameInputSvc.exe
PerceptionSimulationService.exe
alg.exe
msdtc.exe
memory/832-236-0x0000026064420000-0x0000026064486000-memory.dmp
memory/832-235-0x00007FF7171E0000-0x00007FF7172A8000-memory.dmp
memory/832-237-0x0000026064420000-0x0000026064486000-memory.dmp
memory/1072-59-0x00000195A3C80000-0x00000195A3CE6000-memory.dmp
memory/1072-58-0x00000195A3A40000-0x00000195A3B5C000-memory.dmp
memory/1072-60-0x00000195A3C80000-0x00000195A3CE6000-memory.dmp
memory/1444-261-0x00000173835F0000-0x0000017383656000-memory.dmp
memory/1444-243-0x00007FF7171E0000-0x00007FF7172A8000-memory.dmp
memory/1444-260-0x00000173835F0000-0x0000017383656000-memory.dmp
memory/3312-15-0x00007FF7D0A10000-0x00007FF7D0B32000-memory.dmp
memory/3312-17-0x0000025B58790000-0x0000025B587F6000-memory.dmp
memory/3312-18-0x0000025B58790000-0x0000025B587F6000-memory.dmp
memory/3312-16-0x0000025B58790000-0x0000025B587F6000-memory.dmp
memory/3312-64-0x00007FF7D0A10000-0x00007FF7D0B32000-memory.dmp
memory/3424-0-0x0000000002600000-0x0000000002792000-memory.dmp
memory/3424-7-0x00000000027A0000-0x0000000002809000-memory.dmp
memory/3424-1-0x00000000027A0000-0x0000000002809000-memory.dmp
memory/3932-266-0x0000019CDFFA0000-0x0000019CE0006000-memory.dmp
memory/3932-267-0x0000019CDFFA0000-0x0000019CE0006000-memory.dmp
memory/3932-259-0x00007FF7A2D60000-0x00007FF7A2EA9000-memory.dmp
memory/4204-248-0x0000021F3FFA0000-0x0000021F40006000-memory.dmp
memory/4204-247-0x00007FF69B7E0000-0x00007FF69B8F9000-memory.dmp
memory/4204-249-0x0000021F3FFA0000-0x0000021F40006000-memory.dmp
memory/4740-39-0x000002B60AB50000-0x000002B60ABB6000-memory.dmp
memory/4740-38-0x000002B60AB50000-0x000002B60ABB6000-memory.dmp
memory/4740-40-0x000002B60AB50000-0x000002B60ABB6000-memory.dmp
memory/4740-37-0x000002B60A910000-0x000002B60AA2C000-memory.dmp
memory/5476-279-0x0000000000920000-0x0000000000989000-memory.dmp
memory/5476-274-0x0000000000920000-0x0000000000989000-memory.dmp
memory/5476-273-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/5700-47-0x00000249ABDB0000-0x00000249ABE16000-memory.dmp
memory/5700-55-0x00007FF65BF00000-0x00007FF65C068000-memory.dmp
memory/5700-46-0x00007FF65BF00000-0x00007FF65C068000-memory.dmp
memory/5700-53-0x00000249ABDB0000-0x00000249ABE16000-memory.dmp
memory/5700-48-0x00000249ABDB0000-0x00000249ABE16000-memory.dmp
memory/5856-31-0x000002252EE00000-0x000002252EE66000-memory.dmp
memory/5856-29-0x000002252EE00000-0x000002252EE66000-memory.dmp
memory/5856-30-0x000002252EE00000-0x000002252EE66000-memory.dmp
memory/5856-28-0x000002252EC10000-0x000002252ED2C000-memory.dmp