Overview

overview

6

Static

static

1

2026-04-21...op.exe

windows10-2004-x64

6

2026-04-21...op.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    21/04/2026, 12:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_0a0d5b0c7febc52c324259b1879c417a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  • Size 24.4MB
  • Sample260421-pt342aat41
  • SHA256 96b2c6be065f9ee8772687faac05e5f9affb04414f1cab47534d1aeeee2659b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoverypersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_0a0d5b0c7febc52c324259b1879c417a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_0a0d5b0c7febc52c324259b1879c417a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\\epdf\epd655.tmp"
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2168
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\unzip32.exe
      "C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\unzip32.exe" ZX "C:\Program Files\ITEKSOFT\ZUGFeRD\\simple.zip"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5928ec.rbs
        • Path C:\Config.Msi\e5928ec.rbs
        • Size 42KB
        • SHA256 bb3800465aaea1d730d2701c5a3a357a9b9a5f37d69b97872523e44457619b73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        simple.zip
        • Path C:\Program Files\ITEKSOFT\ZUGFeRD\simple.zip
        • Size 31KB
        • SHA256 f181974a907731ade773e3b22427d315ea825c001245565188f810f46a6e0f7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        drag2pdf.exe
        • Path C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\drag2pdf.exe
        • Size 3.2MB
        • SHA256 c4b2054dce771d91a050effc3dfab599263f4c57688ebce1e8e09f6500a9a08c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        html2pdf.exe
        • Path C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\html2pdf.exe
        • Size 5.3MB
        • SHA256 969ea0f97d3f3324228d1aa9d6c02aa19ce07a4c76b15773de7585ec2c620dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unzip32.exe
        • Path C:\Program Files\ITEKSOFT\eDocPrinter PDF Pro\unzip32.exe
        • Size 291KB
        • SHA256 3c8de1b28c50fba8d2998eb0ddeedde9feca360c6e507726ad2d0317b99595e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 4KB
        • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 091d69036c9b16637943d618faf6356f3b35731885acda7b24bd92508e051148
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Size 727B
        • SHA256 2c213d9fafd198fce97b424f9befcc4a2195873ef283992703dc90a74046f628
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 727B
        • SHA256 9225fc0096c0ec1c34b1796e28b720083de805c5efe6d1cec8227cfb3aafd2b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 342B
        • SHA256 085bd8727018e1ec8c3e3d4a2d6f6dcd2116d3033244a3378e414c63bff6032d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 f2abcfb2b71b8635ae63ec87eae56c264dad3535e1684e9b3cc56a7799ac3c5d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_33CE05B041E495C130440531CDB83835
        • Size 404B
        • SHA256 1fb94377b78c969a6f074b187eb68c8fb106508104a377de3ce1ca0c830d23a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 560d7e2322252a81e86734b14b1d117a03f0faf9fa335485408c9cf5488c9309
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        epd655.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\epdf\epd655.tmp
        • Size 25.4MB
        • SHA256 a9737808d3559c6bf94c9cdaf483336c10890857de956e8719bcff380cf77fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI2DA3.tmp
        • Path C:\Windows\Installer\MSI2DA3.tmp
        • Size 658KB
        • SHA256 b68619cefbf9249f7db66725c0b9e50dcfb1a4368b7c16453df702333c1a57fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1044-175-0x0000020C83F40000-0x0000020C83F4C000-memory.dmp
        Download

        memory/2168-5-0x000001B5BA0E0000-0x000001B5BA0EC000-memory.dmp
        Download

        memory/2168-222-0x000001B5BA0E0000-0x000001B5BA0EC000-memory.dmp
        Download