Overview

overview

7

Static

static

3

2026-04-19...ee.exe

windows10-2004-x64

7

2026-04-19...ee.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/04/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_8794eb1284425d8279ad35b6e129d376_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
  • Size 1024KB
  • Sample260419-ech3esb19m
  • SHA256 f2ef75d0ae0f656198a29173aa3451062b1800f32fbab1b54bff2d7ceced90a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_8794eb1284425d8279ad35b6e129d376_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_8794eb1284425d8279ad35b6e129d376_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5396
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5796
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.5MB
        • SHA256 7b3e1472e4dcb968e2caa61c0bcee9e2ed1eb3208ecc3808784b1eb456d18f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.9MB
        • SHA256 9cb06eb660262198cea31e499efd3175f837ce31d11f13d4fac1072c49288e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.7MB
        • SHA256 294137867a5316f5280746718fb7cef62e94776fa606f996fe4daf46bfd0ba2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.0MB
        • SHA256 cf9ad8f2ce97d77fbf502c90c84beaa8980997fa7284e57ede5f82b2f40c9aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.1MB
        • SHA256 3fbd6b3f8dc9cadc99dbe361b3333257142b744093d8e715c6d8b2e8a6a08b41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.7MB
        • SHA256 99de6f45f41b76649f778f2325c857fe6bd8bfb5adb2aa85c36f32f3bbc9ad1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.5MB
        • SHA256 5d20acc805093b853aa3a190511d62029d52f23226f2777bc0eed54439552467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.3MB
        • SHA256 71dd6cc4d63c5213ccb4d0b64b4e04b017bdc09eb71d34a98bcb06b1564fe5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.6MB
        • SHA256 db2ebe327d860b6766d98e2928e7728d80a44c2b7fa2e84f8f5e42b3a46e9af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.9MB
        • SHA256 654d7803e2454e034e3f96027c3a1006629abe9a4eb8dbb4c351850d94ec788a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.1MB
        • SHA256 45e138551131f5903ef87549adee62916f4f59b7c606a2e9542a817d22ec5e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.4MB
        • SHA256 ddca7f5c3095a41d1d1a53ebe66145c064b20c810e486fca61ee854983ae0b56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.0MB
        • SHA256 ed81b363305fc40bd1c9bbe6d1941bd6ef6c632879412979c29e738b7968a47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.0MB
        • SHA256 4316e785cbf91aea8ea138936793a7c415fcd2f3c505a68866658e8d286a24f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.0MB
        • SHA256 62cf57565dea80de8dc3f4c99577704717023bbdf2a032d3c68e460b1103d79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.0MB
        • SHA256 e62343836914f689001c33a25e6fb0655208ebdacb1ada689265d23b7e6b3e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.0MB
        • SHA256 c3fa2140d91528e81d354253756f4a2c5cc56892e27b294fdcad1882bae58ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.0MB
        • SHA256 8f722f81013f6645851c3f57f94de535cf0bcd33a84667815f050fc571459d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.1MB
        • SHA256 ef43e509c460c7147c66edc3af044159b05fa3637d2bf80742992e059415a56b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.1MB
        • SHA256 3fab0afff6384c155f50d3c45b095751021b90c450d21901ad55d3b2e0e70268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.1MB
        • SHA256 fb7a1df8ee726dfb03e8974efcec5de7d67448fc1b0cc1f85e2b6dfa195e2977
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.1MB
        • SHA256 e586e2ab0f3d896d101e9c7c12c1fdf479e42f4c803e0f5292dc13c7d16e4812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1024KB
        • SHA256 f2ef75d0ae0f656198a29173aa3451062b1800f32fbab1b54bff2d7ceced90a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 51badb1f99ffc0dcc9a4578f56b07b99e8d0fa6977773e5e5d9ca5ab95a4372a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 d574543e2aa02e394d3a8690d6da62c0bab8005fd874e920422b74a0453dcb86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 f544c595723429164381ae2ec3c00eae6347f208046ef3aa7d8f610f21c035c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 d45ac8e98e5d00dbf32eedead4bb24e5bf4f572a0743af94c78029d55139d990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 9c6446f69c0911d7e7b5af8686f2da52d5d0007bbaf5ed96eb624439c8df4dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 17c7c2b8fdf97b8a7faa4fa9b44aeca9d1bd8b2ec8723fc956e86986a022bdcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 033e21197a15781e550c4caf10f4f9100d818eaa47df9fd58e35bfb0ecdca2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download