Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe
- Size 321KB
- Sample261102-v28mdavygv
- SHA256 b97f6bd83d209512ed16fa721674dd9330724ef8bffad64f03d8372feaa8cc14
- MD5 fb52f5793fcb0657ec60c59bcc0b002e
- SHA1 8266dda62c224843c2528144e25933833691527b
- SHA512 ba5a9c145c48bfbe806bac232b6c7edcadd415568d711480abce8b6d658df67ec0a05f51aa6c4aa529a4f0fbc5640887537ec830f4c4400e9df8d454c62ca843
- SSDEEP 6144:EEGT3NeCs0kow5aOUBGslQLwqYFBwuXdvQLNN/5yClc:EEGT3NeCs0wiGyiwqEwuXdvQ5N/Hl
- TLSH T13E649D18B9E0C175C18634B68969D7F259FDB5B01F6A72DBB7C809784F282D16A3230F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1668 zuml3zb0mdr0zbj1wjvr.exe 4396 msayxuhq.exe 3204 wiiwczgc.exe 5032 msayxuhq.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\knvfcunmy\p3vxliulfg 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe File created C:\Windows\knvfcunmy\p3vxliulfg zuml3zb0mdr0zbj1wjvr.exe File created C:\Windows\knvfcunmy\p3vxliulfg msayxuhq.exe File created C:\Windows\knvfcunmy\p3vxliulfg wiiwczgc.exe File created C:\Windows\knvfcunmy\p3vxliulfg msayxuhq.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname msayxuhq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain msayxuhq.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zuml3zb0mdr0zbj1wjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msayxuhq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4396 msayxuhq.exe 4396 msayxuhq.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe 3204 wiiwczgc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4204 wrote to memory of 1668 4204 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe 83 PID 4396 wrote to memory of 3204 4396 msayxuhq.exe 85 PID 1668 wrote to memory of 5032 1668 zuml3zb0mdr0zbj1wjvr.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\knvfcunmy\zuml3zb0mdr0zbj1wjvr.exe"C:\knvfcunmy\zuml3zb0mdr0zbj1wjvr.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\knvfcunmy\msayxuhq.exe"C:\knvfcunmy\msayxuhq.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5032
-
-
-
C:\knvfcunmy\msayxuhq.exeC:\knvfcunmy\msayxuhq.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\knvfcunmy\wiiwczgc.exewjsv3szngrcg "c:\knvfcunmy\msayxuhq.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3204
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\knvfcunmy\nxpgsnpj
- Size 4B
- SHA256 4f3822edbfe2ad7708e822852367e671fc3c7c8e1418fb5136f99ad576d42730
- MD5 5bfbf489a4f3ab84edf22e201dd56ed0
- SHA1 138f007e0e0de6ecdf13e7c926a39248a15f3d74
- SHA512 8ec3f7f89e39034a597277f13dde65e4259863f3f482fcd8cea7b35758a7b13f40f17498f43d87ab6f1f771791b92073d763e05ca7f37ea509f5f31477d705b7
- MD5 SHA1 SHA512
- Path C:\knvfcunmy\p3vxliulfg
- Size 8B
- SHA256 48005995957c36ebe0bd4a8f20181f83d8341870742e388f6e5bf264df38821e
- MD5 374b46597e9f8b11220f768aef4ea0f5
- SHA1 247c18e94d67076f1e0c42a6f761dfa419348dca
- SHA512 ba6786402bec259c4ff47ff4670a2d00c7f855b6929363550d8a750a8d1907343328707438d05ab8eae16ee5e81ed3e9ab0865b647bd9656365aa7c55bef3b2c
- MD5 SHA1 SHA512
- Path C:\knvfcunmy\zuml3zb0mdr0zbj1wjvr.exe
- Size 321KB
- SHA256 b97f6bd83d209512ed16fa721674dd9330724ef8bffad64f03d8372feaa8cc14
- MD5 fb52f5793fcb0657ec60c59bcc0b002e
- SHA1 8266dda62c224843c2528144e25933833691527b
- SHA512 ba5a9c145c48bfbe806bac232b6c7edcadd415568d711480abce8b6d658df67ec0a05f51aa6c4aa529a4f0fbc5640887537ec830f4c4400e9df8d454c62ca843
- SSDEEP 6144:EEGT3NeCs0kow5aOUBGslQLwqYFBwuXdvQLNN/5yClc:EEGT3NeCs0wiGyiwqEwuXdvQ5N/Hl
- TLSH T13E649D18B9E0C175C18634B68969D7F259FDB5B01F6A72DBB7C809784F282D16A3230F
- MD5 SHA1 SHA512 SSDEEP TLSH