Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe
- Size 321KB
- Sample261102-v28mdavygv
- SHA256 b97f6bd83d209512ed16fa721674dd9330724ef8bffad64f03d8372feaa8cc14
- MD5 fb52f5793fcb0657ec60c59bcc0b002e
- SHA1 8266dda62c224843c2528144e25933833691527b
- SHA512 ba5a9c145c48bfbe806bac232b6c7edcadd415568d711480abce8b6d658df67ec0a05f51aa6c4aa529a4f0fbc5640887537ec830f4c4400e9df8d454c62ca843
- SSDEEP 6144:EEGT3NeCs0kow5aOUBGslQLwqYFBwuXdvQLNN/5yClc:EEGT3NeCs0wiGyiwqEwuXdvQ5N/Hl
- TLSH T13E649D18B9E0C175C18634B68969D7F259FDB5B01F6A72DBB7C809784F282D16A3230F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4684 zuml3zc2vjr0zbj1wjvr.exe 4244 msayxuhq.exe 3728 wiiwczgc.exe 5364 msayxuhq.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\knvfcunmy\p3vxliulfg 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe File created C:\Windows\knvfcunmy\p3vxliulfg zuml3zc2vjr0zbj1wjvr.exe File created C:\Windows\knvfcunmy\p3vxliulfg msayxuhq.exe File created C:\Windows\knvfcunmy\p3vxliulfg wiiwczgc.exe File created C:\Windows\knvfcunmy\p3vxliulfg msayxuhq.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname msayxuhq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain msayxuhq.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zuml3zc2vjr0zbj1wjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msayxuhq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4244 msayxuhq.exe 4244 msayxuhq.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe 3728 wiiwczgc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4684 1700 2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe 89 PID 4244 wrote to memory of 3728 4244 msayxuhq.exe 91 PID 4684 wrote to memory of 5364 4684 zuml3zc2vjr0zbj1wjvr.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\knvfcunmy\zuml3zc2vjr0zbj1wjvr.exe"C:\knvfcunmy\zuml3zc2vjr0zbj1wjvr.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\knvfcunmy\msayxuhq.exe"C:\knvfcunmy\msayxuhq.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5364
-
-
-
C:\knvfcunmy\msayxuhq.exeC:\knvfcunmy\msayxuhq.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\knvfcunmy\wiiwczgc.exewjsv3szngrcg "c:\knvfcunmy\msayxuhq.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3728
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\knvfcunmy\nxpgsnpj
- Size 4B
- SHA256 ec2273e792da3589eb4b21d08b3ac63cf77e2548623b5d73728da4b0599cb78f
- MD5 8b365664f62a33fd1b8d797777b43266
- SHA1 0b411a532c4b7251a26aae3be09fd14444238e3b
- SHA512 a74eb26a95d32068cd6410be0c3b3f4d92305ac3a6a7b05f9f1baad30ed48d1665a461fb180401172f2452fd25afee1dcc5a2ef12a510c6bc1fb9d9655720234
- MD5 SHA1 SHA512
- Path C:\knvfcunmy\p3vxliulfg
- Size 8B
- SHA256 48005995957c36ebe0bd4a8f20181f83d8341870742e388f6e5bf264df38821e
- MD5 374b46597e9f8b11220f768aef4ea0f5
- SHA1 247c18e94d67076f1e0c42a6f761dfa419348dca
- SHA512 ba6786402bec259c4ff47ff4670a2d00c7f855b6929363550d8a750a8d1907343328707438d05ab8eae16ee5e81ed3e9ab0865b647bd9656365aa7c55bef3b2c
- MD5 SHA1 SHA512
- Path C:\knvfcunmy\zuml3zc2vjr0zbj1wjvr.exe
- Size 321KB
- SHA256 b97f6bd83d209512ed16fa721674dd9330724ef8bffad64f03d8372feaa8cc14
- MD5 fb52f5793fcb0657ec60c59bcc0b002e
- SHA1 8266dda62c224843c2528144e25933833691527b
- SHA512 ba5a9c145c48bfbe806bac232b6c7edcadd415568d711480abce8b6d658df67ec0a05f51aa6c4aa529a4f0fbc5640887537ec830f4c4400e9df8d454c62ca843
- SSDEEP 6144:EEGT3NeCs0kow5aOUBGslQLwqYFBwuXdvQLNN/5yClc:EEGT3NeCs0wiGyiwqEwuXdvQ5N/Hl
- TLSH T13E649D18B9E0C175C18634B68969D7F259FDB5B01F6A72DBB7C809784F282D16A3230F
- MD5 SHA1 SHA512 SSDEEP TLSH