Overview

overview

6

Static

static

1

2026-04-21...op.exe

windows10-2004-x64

6

2026-04-21...op.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 12:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_0a0d5b0c7febc52c324259b1879c417a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  • Size 24.4MB
  • Sample260421-pt342aat41
  • SHA256 96b2c6be065f9ee8772687faac05e5f9affb04414f1cab47534d1aeeee2659b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoverypersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_0a0d5b0c7febc52c324259b1879c417a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_0a0d5b0c7febc52c324259b1879c417a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\\epdf\epdFA20.tmp"
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3256
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\unzip32.exe
      "C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\unzip32.exe" ZX "C:\Program Files\ITEKSOFT\ZUGFeRD\\simple.zip"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58cfdf.rbs
        • Path C:\Config.Msi\e58cfdf.rbs
        • Size 42KB
        • SHA256 787bd34b5cf8ae7120742ba6f41a7d1d504c08f7d2795a817ea490e0e7dcc54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        simple.zip
        • Path C:\Program Files\ITEKSOFT\ZUGFeRD\simple.zip
        • Size 31KB
        • SHA256 f181974a907731ade773e3b22427d315ea825c001245565188f810f46a6e0f7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        drag2pdf.exe
        • Path C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\drag2pdf.exe
        • Size 3.2MB
        • SHA256 c4b2054dce771d91a050effc3dfab599263f4c57688ebce1e8e09f6500a9a08c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        html2pdf.exe
        • Path C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\html2pdf.exe
        • Size 5.3MB
        • SHA256 969ea0f97d3f3324228d1aa9d6c02aa19ce07a4c76b15773de7585ec2c620dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unzip32.exe
        • Path C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\unzip32.exe
        • Size 291KB
        • SHA256 3c8de1b28c50fba8d2998eb0ddeedde9feca360c6e507726ad2d0317b99595e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 091d69036c9b16637943d618faf6356f3b35731885acda7b24bd92508e051148
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Size 727B
        • SHA256 2c213d9fafd198fce97b424f9befcc4a2195873ef283992703dc90a74046f628
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 727B
        • SHA256 9225fc0096c0ec1c34b1796e28b720083de805c5efe6d1cec8227cfb3aafd2b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 48d7ec4d42c234dbcc12f7215b36643ef11754f9d23b2f8d088677d31fc28d16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Size 404B
        • SHA256 f624716b00b625ec4c281f85103c24d784fdf67eb0cf8aa74ba3d60f7a796189
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 d1b4c40d939bb64f8872c0fd66987829af991d26ff77c01c2e6189bad58d3047
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        epdFA20.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\epdf\epdFA20.tmp
        • Size 25.4MB
        • SHA256 a9737808d3559c6bf94c9cdaf483336c10890857de956e8719bcff380cf77fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSID477.tmp
        • Path C:\Windows\Installer\MSID477.tmp
        • Size 658KB
        • SHA256 b68619cefbf9249f7db66725c0b9e50dcfb1a4368b7c16453df702333c1a57fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download