d240a3cece9ac9815a3bfbabfb14394a0d511f860ab4934f5704c2bf6b3781dd

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 113KB
Sample260504-tfs45ae191
SHA256 d240a3cece9ac9815a3bfbabfb14394a0d511f860ab4934f5704c2bf6b3781dd
MD5 cc7f2e3df05c01dbb61f2fe104237c7a
SHA1 1084f49f9681ebca157e82402bc42e9f84ebc7af
SHA512 76cbef79dfcebfe78b940d1e9d518788eb46f452a3bf67d52a23f3604d8cb2a284506757b6424da3127f84669e0aa0bc144f93da30bd02752b955877c0801569
SSDEEP 1536:nE3qz4ayX9ioT5Xl8lQWj1vTo5G6kvBzodfjZE4jk5tGwtsqd/fE:a79l86WqGzIfjZEik5tEqdHE
TLSH
T1FFB39E12B981C673C0069171145AE7B2EB3DF9306A799583F39D0BBA5FB12D0663E387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3372	AhnSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run"	2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AhnSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	3372	AhnSvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3372	1080	2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	77
PID 1080 wrote to memory of 3688	1080	2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\ProgramData\AhnLab\AhnSvc.exe
  "C:\ProgramData\AhnLab\AhnSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\2026-05-04_cc7f2e3df05c01dbb61f2fe104237c7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AhnSvc.exe

Path C:\ProgramData\AhnLab\AhnSvc.exe
Size 113KB
SHA256 69a3b0e21a4875e0cdd47a456380cf10191bc805fd613d59ef85e9ea03f50011
MD5 896162f0533cb370ebacd41325d31330
SHA1 e4923f712711135dfe3da4bffed7425f2900d73c
SHA512 7bdc93990b2c04374fe26ffe2ae60bf0acc42b48cf7d2d8036c7b0a6c18f0facdc61ebac875bce85bd477be22ac0c9e6d104b1b1d0be438153946ee86191fddc
SSDEEP 1536:nE3qz4ayX9ioT5Xl8lQWj1vTo5G6kvBzodfjZE4jk5tGwtsqd/f6:a79l86WqGzIfjZEik5tEqdH6
TLSH
T124B39E12B981C673C0069171145AE7B2EB3DF9306A799583F39D0BBA5FB12D0663E387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-6-0x0000000000C20000-0x0000000000CFF000-memory.dmp

Download

memory/3372-7-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/3372-9-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads