Overview

overview

7

Static

static

3

2026-04-19...ee.exe

windows10-2004-x64

7

2026-04-19...ee.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/04/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_8794eb1284425d8279ad35b6e129d376_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
  • Size 1024KB
  • Sample260419-ech3esb19m
  • SHA256 f2ef75d0ae0f656198a29173aa3451062b1800f32fbab1b54bff2d7ceced90a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_8794eb1284425d8279ad35b6e129d376_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_8794eb1284425d8279ad35b6e129d376_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:456
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1060

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.5MB
        • SHA256 7b3e1472e4dcb968e2caa61c0bcee9e2ed1eb3208ecc3808784b1eb456d18f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.9MB
        • SHA256 9cb06eb660262198cea31e499efd3175f837ce31d11f13d4fac1072c49288e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.7MB
        • SHA256 4f5fe85665da9269712e5ac4eae395ecca5d6d61086c37325706a7b463de2ad7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 1.0MB
        • SHA256 cf9ad8f2ce97d77fbf502c90c84beaa8980997fa7284e57ede5f82b2f40c9aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.1MB
        • SHA256 dfd6e2f42b8722f6f7e6a5c02a6598186ac11da60f5c29aeeeab200e52edb0b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.7MB
        • SHA256 99de6f45f41b76649f778f2325c857fe6bd8bfb5adb2aa85c36f32f3bbc9ad1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.5MB
        • SHA256 8334789fefb7a68a1a702dbc7482ecba286897f43dd35a9002b20dfb5751c9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.3MB
        • SHA256 71dd6cc4d63c5213ccb4d0b64b4e04b017bdc09eb71d34a98bcb06b1564fe5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.6MB
        • SHA256 e4a7818d89d3362da996a2452ee26fc2c3f48ecea62cc538bcec792f2e76e2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.9MB
        • SHA256 7b7a0a5babc473bcaa608c84b4d678148cc793722c5fa47387bef802816a9438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.1MB
        • SHA256 45e138551131f5903ef87549adee62916f4f59b7c606a2e9542a817d22ec5e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.4MB
        • SHA256 fee505d41bfa24f68fec8395dbfdad61d899f3403869323918d717fa39f73259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.0MB
        • SHA256 ed81b363305fc40bd1c9bbe6d1941bd6ef6c632879412979c29e738b7968a47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.0MB
        • SHA256 4316e785cbf91aea8ea138936793a7c415fcd2f3c505a68866658e8d286a24f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.0MB
        • SHA256 62cf57565dea80de8dc3f4c99577704717023bbdf2a032d3c68e460b1103d79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.0MB
        • SHA256 e62343836914f689001c33a25e6fb0655208ebdacb1ada689265d23b7e6b3e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.0MB
        • SHA256 c3fa2140d91528e81d354253756f4a2c5cc56892e27b294fdcad1882bae58ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.0MB
        • SHA256 8f722f81013f6645851c3f57f94de535cf0bcd33a84667815f050fc571459d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.1MB
        • SHA256 ef43e509c460c7147c66edc3af044159b05fa3637d2bf80742992e059415a56b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.1MB
        • SHA256 3fab0afff6384c155f50d3c45b095751021b90c450d21901ad55d3b2e0e70268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.1MB
        • SHA256 fb7a1df8ee726dfb03e8974efcec5de7d67448fc1b0cc1f85e2b6dfa195e2977
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.1MB
        • SHA256 e586e2ab0f3d896d101e9c7c12c1fdf479e42f4c803e0f5292dc13c7d16e4812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 1024KB
        • SHA256 f2ef75d0ae0f656198a29173aa3451062b1800f32fbab1b54bff2d7ceced90a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 51badb1f99ffc0dcc9a4578f56b07b99e8d0fa6977773e5e5d9ca5ab95a4372a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 d574543e2aa02e394d3a8690d6da62c0bab8005fd874e920422b74a0453dcb86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 d45ac8e98e5d00dbf32eedead4bb24e5bf4f572a0743af94c78029d55139d990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 9c6446f69c0911d7e7b5af8686f2da52d5d0007bbaf5ed96eb624439c8df4dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 17c7c2b8fdf97b8a7faa4fa9b44aeca9d1bd8b2ec8723fc956e86986a022bdcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 1024KB
        • SHA256 033e21197a15781e550c4caf10f4f9100d818eaa47df9fd58e35bfb0ecdca2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download