f767a9d4ae50ac0c52f1e4f70c91155a8acca96e4b6d4ddd9d84fb3f446a5aa5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Size 123KB
Sample260417-ccph4agw3x
SHA256 f767a9d4ae50ac0c52f1e4f70c91155a8acca96e4b6d4ddd9d84fb3f446a5aa5
MD5 bd6605942539f6e9c6510a8d507e5685
SHA1 e2085a35df4431e9a539f985963c91ca10f27d2f
SHA512 e487003d25bb8b7b225873febc1d96c953143bd90234676747297f28297831d84769637547ea36ff8274b3e393ec91d83b1a980b5b9e0e0730c247c6d9a90e26
SSDEEP 1536:8L6Udq46SU+y1bQiZclZ4huArbnpkLxn5tFn/6z9k5bIpwtsy:8u4ffrlO1a5tFn/6pk5Uhy
TLSH
T12BC38D217941D477C0869A700819E3A5BA3D79316AB85183F75F0FBA9FB22D0F93D24B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5772	AhnSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run"	2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AhnSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5384	2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5772	AhnSvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 5772	5384	2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe	78
PID 5384 wrote to memory of 4900	5384	2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5384
- C:\ProgramData\AhnLab\AhnSvc.exe
  "C:\ProgramData\AhnLab\AhnSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\2026-04-17_bd6605942539f6e9c6510a8d507e5685_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AhnSvc.exe

Path C:\ProgramData\AhnLab\AhnSvc.exe
Size 123KB
SHA256 a74b1023c495eaf493e46aa043b9369453924958f8cb95820fe8e3afe11763b3
MD5 8795729610a6cae90f0e34e3991aaf0a
SHA1 597620b266f200c4cb959daac534ab5e1cef7c32
SHA512 5132a3c01defa3e877507d68798f2bcdb91e8936aaa6191847e8d13ec3e16eaf3450cfe4aa8e0641e86dce3b378b9e4469887ab1a5138797df208b406d0b3e90
SSDEEP 1536:8L6Udq46SU+y1bQiZclZ4huArbnpkLxn5tFn/6z9k5bIpwtsv:8u4ffrlO1a5tFn/6pk5Uhv
TLSH
T1A3C38D217941D477C0869A700819E3A5BA3D79316AB85183F75F0FBA9FB22D0F93D24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5384-6-0x0000000001690000-0x000000000176F000-memory.dmp

Download

memory/5772-7-0x0000000000F90000-0x0000000000FAF000-memory.dmp

Download

memory/5772-8-0x0000000000F90000-0x0000000000FAF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads