Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/04/2026, 07:29
General
- Target 2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop.exe
- Size 1.9MB
- Sample260403-jbkxvae13v
- SHA256 e532087766ad9b0de69c1c2ba16d05c0ba09afdcfb141a20b11f173044fa36dc
Malware Config
Signatures
- Detects Pitou bootkit 4 IoCs
- Pitou
Pitou is a Windows bootkit written in C++.
- Pitou family
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3088-1-0x0000000000840000-0x0000000000940000-memory.dmp
memory/3088-2-0x00000000023B0000-0x000000000241B000-memory.dmp
memory/3088-3-0x0000000000410000-0x0000000000411000-memory.dmp
memory/3088-5-0x0000000000400000-0x000000000061A000-memory.dmp
memory/3088-6-0x0000000000400000-0x000000000061A000-memory.dmp
memory/3088-7-0x0000000000840000-0x0000000000940000-memory.dmp
memory/3088-8-0x00000000023B0000-0x000000000241B000-memory.dmp
memory/3088-10-0x0000000000400000-0x000000000061A000-memory.dmp
memory/3088-11-0x0000000000400000-0x000000000061A000-memory.dmp