97028f5916c935af1e782436c220610f0e694ef9f1a91276cb8fb6f579919e9a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_dc3bde43c020be9c242daa39735d6a6b_elex_redline-stealer_smoke-loader.exe
Size 1.5MB
Sample261023-vth2racy4v
SHA256 97028f5916c935af1e782436c220610f0e694ef9f1a91276cb8fb6f579919e9a
MD5 dc3bde43c020be9c242daa39735d6a6b
SHA1 4714c56587b3a534469bcaf582c7c2966c7722f3
SHA512 72a4a3ede3c2c494b7dc09524880e6cfeceeeeb8aa8de54868acfb828a4c6876d20428b3b53ae3d258c93ef9d21fa360c3a623d4c85c76c1df0d7d2b2ec0d2ec
SSDEEP 24576:E5AEEJKR4cV9ketnTryPYmqRKHbJC6WhFr4+ioNImHavlh:52d9kVPYkHbJCH/r4zoeoa3
TLSH
T133657D02F7D6C072EDA3297928BB921D5A7E75050F35D8D7A3682F6E49333C1893A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_dc3bde43c020be9c242daa39735d6a6b_elex_redline-stealer_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc3bde43c020be9c242daa39735d6a6b_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc3bde43c020be9c242daa39735d6a6b_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/124-0-0x0000000003677000-0x0000000003678000-memory.dmp

Download