Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 10.3MB
- Sample260522-3br6psf16p
- SHA256 bc4c43c0ca5147a60a6967a5b99d570dc7be0fe2e8ea5c139da21fff4e9a3ebd
- MD5 b106ff8e3c0120cc4a560d816e1b4fa3
- SHA1 ff9f19d0c14fc85157c8eba6d2ef4d89ff1f9c70
- SHA512 b042cf5a2f0b0a6fbce52c9a6c86e0a1f58e08f2e6470a64f16ef3134cf8ca65821f50933b4c37e2b6fa0d6fef4fe496a93f38e38c1d55eca4a4f5a76cc6b898
- SSDEEP 196608:2+0AYl1w1wxe8DDtTA1vS+PneNegmaIVrqEd6Wq20xhGRV3oOaDJUQsb6rD:2+XYl1e189TGvS+PnHfrH672ihGH3oOq
- TLSH T16CB63386F59AAA16C27620BD14C3CBD52378E116432C4BC371EE0B6E9F763A79B51313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2092 msiexec.exe 3 2092 msiexec.exe 4 2092 msiexec.exe 5 2092 msiexec.exe 6 2092 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2092 msiexec.exe Token: SeIncreaseQuotaPrivilege 2092 msiexec.exe Token: SeSecurityPrivilege 2836 msiexec.exe Token: SeCreateTokenPrivilege 2092 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2092 msiexec.exe Token: SeLockMemoryPrivilege 2092 msiexec.exe Token: SeIncreaseQuotaPrivilege 2092 msiexec.exe Token: SeMachineAccountPrivilege 2092 msiexec.exe Token: SeTcbPrivilege 2092 msiexec.exe Token: SeSecurityPrivilege 2092 msiexec.exe Token: SeTakeOwnershipPrivilege 2092 msiexec.exe Token: SeLoadDriverPrivilege 2092 msiexec.exe Token: SeSystemProfilePrivilege 2092 msiexec.exe Token: SeSystemtimePrivilege 2092 msiexec.exe Token: SeProfSingleProcessPrivilege 2092 msiexec.exe Token: SeIncBasePriorityPrivilege 2092 msiexec.exe Token: SeCreatePagefilePrivilege 2092 msiexec.exe Token: SeCreatePermanentPrivilege 2092 msiexec.exe Token: SeBackupPrivilege 2092 msiexec.exe Token: SeRestorePrivilege 2092 msiexec.exe Token: SeShutdownPrivilege 2092 msiexec.exe Token: SeDebugPrivilege 2092 msiexec.exe Token: SeAuditPrivilege 2092 msiexec.exe Token: SeSystemEnvironmentPrivilege 2092 msiexec.exe Token: SeChangeNotifyPrivilege 2092 msiexec.exe Token: SeRemoteShutdownPrivilege 2092 msiexec.exe Token: SeUndockPrivilege 2092 msiexec.exe Token: SeSyncAgentPrivilege 2092 msiexec.exe Token: SeEnableDelegationPrivilege 2092 msiexec.exe Token: SeManageVolumePrivilege 2092 msiexec.exe Token: SeImpersonatePrivilege 2092 msiexec.exe Token: SeCreateGlobalPrivilege 2092 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3840 wrote to memory of 2092 3840 2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_b106ff8e3c0120cc4a560d816e1b4fa3_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\\epdf\epd97B8.tmp"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2092
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\epdf\epd97B8.tmp
- Size 10.7MB
- SHA256 33db6ca40964fac10013d0c26412022db971375afe5d545e06f4fd84335f2fbd
- MD5 51b9fa424c0343838761159c3ed6cb74
- SHA1 9b9b87bce105563bbc0719bf2c4629b6e24364e0
- SHA512 436b9feed42e97e079ac926070fed0c6f54ba412642331353922b5672f613b5ef8d63dc87b47c717ca764f2b3b893101a7b535a1b4fd18230e88aa02db8298e3
- SSDEEP 196608:Ew0PGybjRfITmaqCI2WPyeljclMEYBaK09mE36CUYi9hEDRhM2qYgswY1Q:Ewhybj5faKJPyeljxER9J6lYmhE9hM2
- TLSH T129B62385F69706A4CDA3917D4952D692F730BC014770CB8B129DB71A2FF37A24E36B22
- MD5 SHA1 SHA512 SSDEEP TLSH