0xblack.dev Malware research · ARGUS

739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f.exe

Published 2026-08-03 06:28 UTC · ARGUS

Summary

Verdict

SUSPICIOUS confidence 95% (high)

Family

RedLineStealer

SHA-256

739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f

Packing

unknown/custom (entropy 7.6)

Signals

yara-match, executable-drop, child-processes, packed

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (5)

C:\Users\researcher\AppData\Roaming\cipnby.exe
C:\Users\researcher\AppData\Roaming\fdadyy.exe
C:\Users\researcher\AppData\Roaming\izmewo.exe
C:\Users\researcher\AppData\Roaming\nfxohx.exe
C:\argus-vr-agent\quarantine\739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f_extracted\739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f.exe

Dropped files (8)

C:\Users\RESEAR~1\AppData\Local\Temp\is-1FAIPW7RKO.tmp\_isetup\_isdecmp.dll
C:\Users\researcher\AppData\Roaming\cipnby.exe
C:\Users\researcher\AppData\Roaming\izmewo.exe
C:\Users\researcher\AppData\Roaming\lfnujhi.exe
C:\Users\researcher\AppData\Roaming\nfxohx.exe
C:\Users\researcher\AppData\Roaming\njsldv.exe
C:\Users\researcher\AppData\Roaming\ocnqpq.exe
C:\Users\researcher\AppData\Roaming\fdadyy.exe

MITRE ATT&CK

T1105 Ingress Tool Transfer / staged payloadT1059 Command and Scripting InterpreterT1027.002 Obfuscated Files or Information: Software Packing

YARA matches

Injection_API_ComboDownloader_APIsPersistence_RunKeyEmbedded_Executable

Indicators of Compromise (defanged)

3cb297e191cc064a4bca8f37bf2f17bf
b1f6f9ef0a6709ff783f91dbd2530aca1b4fb21b
C:\Users\RESEAR~1\AppData\Local\Temp\is-1FAIPW7RKO.tmp\_isetup\_isdecmp.dll
C:\Users\researcher\AppData\Roaming\cipnby.exe
C:\Users\researcher\AppData\Roaming\fdadyy.exe
C:\Users\researcher\AppData\Roaming\izmewo.exe
C:\Users\researcher\AppData\Roaming\lfnujhi.exe
C:\Users\researcher\AppData\Roaming\nfxohx.exe
C:\Users\researcher\AppData\Roaming\njsldv.exe
C:\Users\researcher\AppData\Roaming\ocnqpq.exe

IOCs (JSON)

{
  "sha256": "739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f",
  "family": "RedLineStealer",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "yara-match",
    "executable-drop",
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1105",
    "T1059",
    "T1027.002"
  ],
  "dropped": [
    "C:\\Users\\RESEAR~1\\AppData\\Local\\Temp\\is-1FAIPW7RKO.tmp\\_isetup\\_isdecmp.dll",
    "C:\\Users\\researcher\\AppData\\Roaming\\cipnby.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\izmewo.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\lfnujhi.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\nfxohx.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\njsldv.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\ocnqpq.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\fdadyy.exe"
  ],
  "children": [
    "C:\\Users\\researcher\\AppData\\Roaming\\cipnby.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\fdadyy.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\izmewo.exe",
    "C:\\Users\\researcher\\AppData\\Roaming\\nfxohx.exe",
    "C:\\argus-vr-agent\\quarantine\\739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f_extracted\\739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f.exe"
  ]
}

ARGUS · 0xblack.dev