Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 15:23
General
- Target 2026-05-11_abd52d1b84642588dd77ee1bd285e02c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 1.3MB
- Sample260511-ssshpads9x
- SHA256 5da3c4401672d9761bd2f4fa11613cbb9c0e070d16a56cb393559b3e9b5cc817
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 14 IoCs
- Modifies Internet Explorer start page 1 TTPs 2 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_abd52d1b84642588dd77ee1bd285e02c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_abd52d1b84642588dd77ee1bd285e02c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 20442⤵
- Program crash
-
-
C:\Users\Admin\AppData\Roaming\cssrs.exeC:\Users\Admin\AppData\Roaming\cssrs.exe1⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cssrs.exeC:\Users\Admin\AppData\Roaming\cssrs.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 16122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4280 -ip 42801⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
cssrs.exe
memory/2656-0-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2656-2-0x00000000779C4000-0x00000000779C5000-memory.dmp
memory/2656-3-0x00000000779C5000-0x00000000779C6000-memory.dmp
memory/2656-1-0x000000007FE70000-0x000000007FE7C000-memory.dmp
memory/2656-4-0x000000007FE70000-0x000000007FE7C000-memory.dmp
memory/2656-5-0x000000007FE70000-0x000000007FE7C000-memory.dmp
memory/2656-12-0x000000007FE70000-0x000000007FE7C000-memory.dmp
memory/2656-13-0x000000007FE70000-0x000000007FE7C000-memory.dmp
memory/2656-18-0x000000007FE70000-0x000000007FE7C000-memory.dmp
memory/2656-21-0x0000000002AA0000-0x0000000002B04000-memory.dmp
memory/2656-22-0x0000000000400000-0x0000000000560000-memory.dmp
memory/4280-31-0x000000007FE60000-0x000000007FE6C000-memory.dmp
memory/4280-34-0x000000007FE60000-0x000000007FE6C000-memory.dmp
memory/4280-28-0x000000007FE70000-0x000000007FE7B000-memory.dmp
memory/4280-44-0x0000000000400000-0x0000000000560000-memory.dmp
memory/4280-32-0x000000007FE60000-0x000000007FE6C000-memory.dmp
memory/4280-33-0x000000007FE60000-0x000000007FE6C000-memory.dmp
memory/4280-43-0x0000000004580000-0x00000000045E4000-memory.dmp
memory/4280-30-0x000000007FE70000-0x000000007FE7B000-memory.dmp
memory/4280-38-0x000000007FE60000-0x000000007FE6C000-memory.dmp
memory/4280-36-0x000000007FE60000-0x000000007FE6C000-memory.dmp
memory/4280-41-0x000000007FE70000-0x000000007FE7B000-memory.dmp
memory/4520-37-0x0000000000400000-0x0000000000560000-memory.dmp
memory/4520-25-0x0000000000400000-0x0000000000560000-memory.dmp
memory/4784-35-0x0000000000400000-0x0000000000560000-memory.dmp
memory/4784-27-0x0000000000400000-0x0000000000560000-memory.dmp