dd9e2d81a0303b042069ac59284bac297207aa1c5bd92a71df57ba4fc1a4102c

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Size 123KB
Sample260424-er24vaev7z
SHA256 dd9e2d81a0303b042069ac59284bac297207aa1c5bd92a71df57ba4fc1a4102c
MD5 82b6446dcb0f17d0da846bf6bc2ca5f6
SHA1 b1095d42ab70a2192a105b24d9e4a10c7e09b8fb
SHA512 1177e8f5916a7012c1a17464bb689eb32e65710f90c267676126cd8bc06e34088b4639b325ce38db27d86914174b49267d2ac2b65e5876485611cd4a3dcfbe85
SSDEEP 1536:82Fb4bdd6M1I23CsoX/DHZclZ4gQhuArbnSOkLxnVDtFn/wo6k5UpwtsZ:Hh4HZ1r3QvmlVQ1SX5tFn/B6k5UhZ
TLSH
T1D6C38D217881C0B7C04AD5B00919D361EA7F7D3296B85583F7990BBA9FB13D07A3D26B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1028	AhnSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run"	2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AhnSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	1028	AhnSvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1028	5068	2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe	79
PID 5068 wrote to memory of 3436	5068	2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\ProgramData\AhnLab\AhnSvc.exe
  "C:\ProgramData\AhnLab\AhnSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\2026-04-24_82b6446dcb0f17d0da846bf6bc2ca5f6_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AhnSvc.exe

Path C:\ProgramData\AhnLab\AhnSvc.exe
Size 123KB
SHA256 0d0934eb8efe8889a5b4afe5dee1b7b4f14a50a15cde2e65e5ea6f2350f8fe92
MD5 6e6beb327159239cc6fdc87d98c58d61
SHA1 069cfd74efb525aee70da72661baf974f75bd8d1
SHA512 7f6d5e8d49aa01d8e3861effc70819ee001f7792c06c9716a1e3195ec300d43e00879c80f027311ed85c0e67f7b76ed50dd28e77541058fb6620c7d25015f58b
SSDEEP 1536:82Fb4bdd6M1I23CsoX/DHZclZ4gQhuArbnSOkLxnVDtFn/wo6k5Upwts6:Hh4HZ1r3QvmlVQ1SX5tFn/B6k5Uh6
TLSH
T1B0C38D217881C0B7C04AD5B00919D361EA7F7D3296B85583F7990BBA9FB13D07A3D26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-6-0x00000000001F0000-0x000000000020F000-memory.dmp

Download

memory/1028-11-0x00000000001F0000-0x000000000020F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads