Overview

overview

10

Static

static

10

2026-04-25...er.exe

windows10-2004-x64

10

2026-04-25...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/04/2026, 14:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe
  • Size 212KB
  • Sample260425-rdsdpscz2r
  • SHA256 433794ceff5a56d5fb6ebea5ab38f081858a9909453faeec36b79b455f94c985
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 52 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe"
      2⤵
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3868
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\Lab21-02x.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4740
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /c C:\Windows\system32\Lab21-02x.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\SysWOW64\Lab21-02x.exe
              C:\Windows\system32\Lab21-02x.exe
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2776

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 b29d2b87e91f82d764ee7ab5947dbf9f3e2b9dc473e571ef1b67622d35cb9b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 318KB
        • SHA256 28383114ddb138b10a7658bd4b0709fd6e496335cef5d5da827f2687077e5add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe
        • Size 546KB
        • SHA256 3bee29dd355e50cdf24736a2a53d8fffd9cd93e702109f20d65a7e2e2fcfd9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 366KB
        • SHA256 22057bedcf7f73b29bfc113e16f8798adce3ac88462e96174c03af175f832ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ELEVAT~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\ELEVAT~2.EXE
        • Size 2.3MB
        • SHA256 b93cdd0b2b72f428fc2561176a313143042beaf8d12ef11c9544512e68afdb2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~1.EXE
        • Size 3.4MB
        • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~2.EXE
        • Size 1.5MB
        • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~3.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~3.EXE
        • Size 1.8MB
        • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\PWAHEL~1.EXE
        • Size 1.4MB
        • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateComRegisterShell64.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 244KB
        • SHA256 7c9bd83409f49cf3e25c407d0847dc141c92b18437a2c32f2d29e255780c24e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe
        • Size 290KB
        • SHA256 efb809ba7db6326d0ebd806c2982ea2851b52b6189ee42245fc0af2c18204a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\BHO\ie_to_edge_stub.exe
        • Size 557KB
        • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\INSTAL~1\setup.exe
        • Size 6.6MB
        • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\cookie_exporter.exe
        • Size 202KB
        • SHA256 17ea5b8913bb61c8dea99d1a849c36c4ee6c650694920e98039a21c46de6bdb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\elevation_service.exe
        • Size 1.8MB
        • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\identity_helper.exe
        • Size 1.1MB
        • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\msedge.exe
        • Size 3.8MB
        • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\msedge_proxy.exe
        • Size 1.1MB
        • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\msedge_pwa_launcher.exe
        • Size 1.5MB
        • SHA256 25a987c987b69ecdd3f848e2525a4e4ecbefa5501ab79fd644c134538d1faf7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\msedgewebview2.exe
        • Size 3.3MB
        • SHA256 bb20a839474206f27d2d8cb20c48a0c8f9f00e44dcf660c7e07d26820e89d930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\notification_helper.exe
        • Size 1.3MB
        • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pwahelper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeWebView\Application\132029~1.140\pwahelper.exe
        • Size 1.1MB
        • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 562KB
        • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe
        • Size 195KB
        • SHA256 aebd1676461cd6e6ff21e717fb0b6d26e189cca2479df3f6cddf016407aa8407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_helper.exe
        • Size 1.7MB
        • SHA256 f1e65e27e2cdc6003fb5cb4c1dbfee5215066d0980fd1c8434c9774e5657ea58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe
        • Size 4.0MB
        • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNINST~1.EXE
        • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
        • Size 141KB
        • SHA256 294a66a0948d474fafaac4ab64279d58d648c488271c265f27feef305075b04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
        • Size 494KB
        • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INTEGR~1.EXE
        • Path C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
        • Size 6.7MB
        • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WINDOW~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE
        • Size 650KB
        • SHA256 a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
        • Size 495KB
        • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
        • Size 485KB
        • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_RED~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WINDOW~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{5625B~1\WINDOW~1.EXE
        • Size 689KB
        • SHA256 f464fba264dac0da8ef65ccb941869e53d49c3bd16565d47f9ac8102a5a18494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_RED~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
        • Size 536KB
        • SHA256 4798142637154af13e3ed0e0b508459cf71d2dc1ae2f80f8439d14975617e05c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
        • Size 485KB
        • SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WINDOW~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{EF5AF~1\WINDOW~1.EXE
        • Size 650KB
        • SHA256 671be498af4e13872784eeae4bae2e462dfac62d51d7057b2b3bebff511b7d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneDrive.exe
        • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
        • Size 1.6MB
        • SHA256 0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-04-25_3d52539fcf15d89eb8ca887e508a1805_amadey_elex_neshta_redline-stealer_rhadamanthys_smoke-loader.exe
        • Size 172KB
        • SHA256 f82543bccf128322625e26c1f824246377c6fc25af55a4f859012b69b3d4e168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lab21-02x.dll
        • Path C:\Windows\SysWOW64\Lab21-02x.dll
        • Size 51KB
        • SHA256 1ac05ffe723d69c999b99c48989c681d3428ac74e5f7bd2e43f0fe67e571b484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lab21-02x.exe
        • Path C:\Windows\SysWOW64\Lab21-02x.exe
        • Size 38KB
        • SHA256 60453f0ef0b07bede010f0d6c5766c35f6c9c232908909636cd25a078328323c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 64B
        • SHA256 ec4d68abf684a0ffe52b5b2e13271f1a48f6e19c3f02568958bb0e8dc136f1f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2016-206-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2016-198-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2016-202-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2016-199-0x0000000000970000-0x0000000000A2B000-memory.dmp
        Download

        memory/2016-207-0x0000000000970000-0x0000000000A2B000-memory.dmp
        Download

        memory/2016-213-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2016-214-0x0000000000970000-0x0000000000A2B000-memory.dmp
        Download

        memory/4740-200-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4740-201-0x0000000000850000-0x000000000090B000-memory.dmp
        Download

        memory/4740-204-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4740-208-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4740-211-0x0000000000400000-0x000000000041B000-memory.dmp
        Download