Overview

overview

10

Static

static

3

2026-05-11...op.exe

windows10-2004-x64

10

2026-05-11...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/05/2026, 08:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  • Size 555KB
  • Sample260511-ksc41ady2v
  • SHA256 4721c88ca5bee84bf95f56f2cb9b3420cd9d7f92ead67e97c3d4389a04307324
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionsalitypersistencetrojanupx

Malware Config

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Signatures

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    defense_evasiontrojan
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
  • UPX dump on OEP (original entry point) 42 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 13 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:820
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:828
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:788
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2616
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2896
            • C:\Windows\Explorer.EXE
              C:\Windows\Explorer.EXE
              1⤵
                PID:3140
                • C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
                  2⤵
                  • Modifies firewall policy service
                  • UAC bypass
                  • Windows security bypass
                  • Windows security modification
                  • Checks whether UAC is enabled
                  • Enumerates connected drives
                  • Drops autorun.inf file
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: RenamesItself
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2332
                  • C:\Windows\SysWOW64\system.exe
                    C:\Windows\system32\system.exe
                    3⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1968
                    • C:\Windows\SysWOW64\Rundll32.exe
                      Rundll32 C:\Windows\system32\ujussgaa.dll Exucute
                      4⤵
                      • Loads dropped DLL
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:5004
                      • C:\Windows\SysWOW64\net.exe
                        net stop WinDefend
                        5⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4856
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop WinDefend
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:5612
                      • C:\Windows\SysWOW64\net.exe
                        net stop MpsSvc
                        5⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4964
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop MpsSvc
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:1508
                      • C:\Windows\SysWOW64\sc.exe
                        sc config WinDefend start= disabled
                        5⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:1864
                      • C:\Windows\SysWOW64\sc.exe
                        sc config MpsSvc start= disabled
                        5⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:2652
                      • C:\Windows\SysWOW64\sc.exe
                        "C:\Windows\System32\sc.exe" stop PolicyAgent
                        5⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4828
                    • C:\Windows\SysWOW64\Rundll32.exe
                      Rundll32 C:\Windows\system32\ewjusgaa.dll Exucute
                      4⤵
                      • Badlisted process makes network request
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4364
                  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4968
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                1⤵
                  PID:3260
                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                  1⤵
                    PID:3528
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3544
                    • C:\Windows\System32\RuntimeBroker.exe
                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                      1⤵
                        PID:3640
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3688
                        • C:\Windows\system32\DllHost.exe
                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                          1⤵
                            PID:3760
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                            1⤵
                              PID:3792
                            • C:\Windows\system32\DllHost.exe
                              C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                              1⤵
                                PID:4012

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Replication Through Removable Media

                                    1
                                    T1091

                                    Execution

                                    System Services

                                    2
                                    T1569

                                    Service Execution

                                    2
                                    T1569.002

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    3
                                    T1543

                                    Windows Service

                                    3
                                    T1543.003

                                    Privilege Escalation

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    3
                                    T1543

                                    Windows Service

                                    3
                                    T1543.003

                                    Defense Evasion

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Impair Defenses

                                    5
                                    T1562

                                    Disable or Modify System Firewall

                                    1
                                    T1562.004

                                    Disable or Modify Tools

                                    3
                                    T1562.001

                                    Modify Registry

                                    6
                                    T1112

                                    Credential Access

                                    Discovery

                                    Peripheral Device Discovery

                                    1
                                    T1120

                                    Query Registry

                                    1
                                    T1012

                                    System Information Discovery

                                    3
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    Lateral Movement

                                    Replication Through Removable Media

                                    1
                                    T1091

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Service Stop

                                    2
                                    T1489

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecf6411afeadd099b6bfabf56706c309_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
                                    • Size 59KB
                                    • SHA256 bb80f880d718afd020ec9cf246d6c6e41e70fd4a5ecb54f47be8296683e503c5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    4ED7.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\4ED7.tmp
                                    • Size 4.5MB
                                    • SHA256 796824b4240d8ec77e739d4611a79ceda4a9b618143b2c6a3d0d12f20053e1f3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ewjusgaa.dll
                                    • Path C:\Windows\SysWOW64\ewjusgaa.dll
                                    • Size 21KB
                                    • SHA256 ed8c448132ce53c3e2cf1e6e4586c12ce5587dc4484576dfb0703ec5890659e1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    system.exe
                                    • Path C:\Windows\SysWOW64\system.exe
                                    • Size 492KB
                                    • SHA256 25e67e682ed31fa5939f21733515a01ee9cd9eee63576109eee6d9a9fd6c4c50
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ujussgaa.dll
                                    • Path C:\Windows\SysWOW64\ujussgaa.dll
                                    • Size 61KB
                                    • SHA256 34818d6c3335477ceb1c2e8d5448408acd9bf53cb48a570ad9f2a49664526959
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    hpce.exe
                                    • Path F:\hpce.exe
                                    • Size 97KB
                                    • SHA256 32b3bed3d84bf3703f86beb99f4d1cad0c03490bafe606986837e9adc77389ed
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1968-13-0x0000000002400000-0x0000000002401000-memory.dmp
                                    Download

                                    memory/1968-20-0x00000000022B0000-0x00000000022B2000-memory.dmp
                                    Download

                                    memory/1968-24-0x00000000022B0000-0x00000000022B2000-memory.dmp
                                    Download

                                    memory/1968-26-0x0000000000400000-0x000000000042B000-memory.dmp
                                    Download

                                    memory/1968-44-0x00000000022B0000-0x00000000022B2000-memory.dmp
                                    Download

                                    memory/2332-59-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-67-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-7-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-28-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-37-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-51-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-36-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-50-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-125-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-34-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-121-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-33-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-27-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-23-0x0000000003880000-0x0000000003882000-memory.dmp
                                    Download

                                    memory/2332-22-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-8-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-118-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-117-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-115-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-19-0x0000000003880000-0x0000000003882000-memory.dmp
                                    Download

                                    memory/2332-11-0x0000000003E10000-0x0000000003E11000-memory.dmp
                                    Download

                                    memory/2332-10-0x0000000003880000-0x0000000003882000-memory.dmp
                                    Download

                                    memory/2332-58-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-0-0x0000000000400000-0x000000000048F000-memory.dmp
                                    Download

                                    memory/2332-60-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-62-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-63-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-65-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-66-0x0000000003880000-0x0000000003882000-memory.dmp
                                    Download

                                    memory/2332-18-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-68-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-110-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-109-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-104-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-103-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-76-0x0000000000400000-0x000000000048F000-memory.dmp
                                    Download

                                    memory/2332-77-0x0000000000A50000-0x0000000000B2F000-memory.dmp
                                    Download

                                    memory/2332-78-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-98-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-97-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-82-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-85-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-87-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-89-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-91-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-93-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-94-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/2332-95-0x0000000000C50000-0x0000000001D0A000-memory.dmp
                                    Download

                                    memory/4364-80-0x0000000000E00000-0x0000000000E4A000-memory.dmp
                                    Download

                                    memory/4364-73-0x00000000033D0000-0x00000000033D2000-memory.dmp
                                    Download

                                    memory/4364-71-0x0000000003460000-0x0000000003461000-memory.dmp
                                    Download

                                    memory/4968-81-0x0000000000C60000-0x0000000000D3F000-memory.dmp
                                    Download

                                    memory/4968-74-0x0000000003180000-0x0000000003181000-memory.dmp
                                    Download

                                    memory/4968-75-0x0000000003030000-0x0000000003032000-memory.dmp
                                    Download

                                    memory/4968-53-0x0000000000400000-0x0000000000412000-memory.dmp
                                    Download

                                    memory/5004-25-0x00000000006B0000-0x00000000006B2000-memory.dmp
                                    Download

                                    memory/5004-21-0x00000000006B0000-0x00000000006B2000-memory.dmp
                                    Download

                                    memory/5004-15-0x00000000006C0000-0x00000000006C1000-memory.dmp
                                    Download

                                    memory/5004-38-0x00000000006B0000-0x00000000006B2000-memory.dmp
                                    Download

                                    memory/5004-41-0x00000000009E0000-0x0000000000A2A000-memory.dmp
                                    Download