Analysis
- max time kernel
146s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 12:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 1.1MB
- Sample260525-prdflaa181
- SHA256 71828ae5d53f817f8535439615750af40a75a62dd6da29563f582c7ce42a5aeb
- MD5 3696bcd9e2e161791fa657827c10ab07
- SHA1 882dde0189fee305ae3ab5f39b40280274c26c27
- SHA512 c97857cd9bcd89c6e6381b168799aa990e8ad550835bc82fd3fe6a5c6a93cb8d2942748916407a478ceeb5b17c6dbae78f57b6a8207f053b2d12e6eea7a00e43
- SSDEEP 3072:cBKqOavcNCpGkDz/ui/NwxDY9OBNkBT0xXRVbT3gU50s6p:qXmkDz8xDYUq0rVbU296p
- TLSH T17235BF1171C4FF72C1533A328961D7F15DEABC6126526B4F2ED926B93F28AE0972130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
2210
Extracted
Family
-
smokeloader
Version
-
2019
C2
-
http://10022020newfolder1002002131-service1002.space/
-
http://10022020newfolder1002002231-service1002.space/
-
http://10022020newfolder3100231-service1002.space/
-
http://10022020newfolder1002002431-service1002.space/
-
http://10022020newfolder1002002531-service1002.space/
-
http://10022020newfolder33417-01242510022020.space/
-
http://10022020test125831-service1002012510022020.space/
-
http://10022020test136831-service1002012510022020.space/
-
http://10022020test147831-service1002012510022020.space/
-
http://10022020test146831-service1002012510022020.space/
-
http://10022020test134831-service1002012510022020.space/
-
http://10022020est213531-service100201242510022020.ru/
-
http://10022020yes1t3481-service1002012510022020.ru/
-
http://10022020test13561-service1002012510022020.su/
-
http://10022020test14781-service1002012510022020.info/
-
http://10022020test13461-service1002012510022020.net/
-
http://10022020test15671-service1002012510022020.tech/
-
http://10022020test12671-service1002012510022020.online/
-
http://10022020utest1341-service1002012510022020.ru/
-
http://10022020uest71-service100201dom2510022020.ru/
-
http://10022020test61-service1002012510022020.website/
-
http://10022020test51-service1002012510022020.xyz/
-
http://10022020test41-service100201pro2510022020.ru/
-
http://10022020yest31-service100201rus2510022020.ru/
-
http://10022020rest21-service1002012510022020.eu/
-
http://10022020test11-service1002012510022020.press/
-
http://10022020newfolder4561-service1002012510022020.ru/
-
http://10022020rustest213-service1002012510022020.ru/
-
http://10022020test281-service1002012510022020.ru/
-
http://10022020test261-service1002012510022020.space/
-
http://10022020yomtest251-service1002012510022020.ru/
-
http://10022020yirtest231-service1002012510022020.ru/
rc4.i32
rc4.i32
Signatures
- Family: SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3208 Process not Found - Loads dropped DLL 1 IoCs
pid Process 5056 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1624 set thread context of 5056 1624 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe 81 - Program crash 1 IoCs
pid pid_target Process procid_target 856 5056 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found 3208 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3208 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5056 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found Token: SeShutdownPrivilege 3208 Process not Found Token: SeCreatePagefilePrivilege 3208 Process not Found - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1624 wrote to memory of 5056 1624 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe 81 PID 1624 wrote to memory of 5056 1624 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe 81 PID 1624 wrote to memory of 5056 1624 2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe 81 PID 3208 wrote to memory of 912 3208 Process not Found - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_3696bcd9e2e161791fa657827c10ab07_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 3883⤵
- Program crash
PID:856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5056 -ip 50561⤵PID:488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\4DD3.tmp
- Size 1.6MB
- SHA256 35f8d721f246ae3e19d204f9bcab3237448ed906a25bba14e7016e5cdd2fc2ce
- MD5 1cf5669feb127f89f57e8e9d9ac11409
- SHA1 d8aaccbbef08cde0161bfbc0f6b7b1e8a1c43d42
- SHA512 7ebf6cc1a5a0d1ad89666af09bbdd947c02fcb933aeb72c8aff1a378582e38e5c816f806afe87038f10215c3c6c11e50f3226146ba3358e4d6005553cf373b08
- SSDEEP 24576:aVt7gjySvKflMZ3wZq6ElHMvJKIZY7VaZA/rOvSBDSnH+XQk7WqITgR:24yZeBwI/OvJKIZaFCvYYq6qIMR
- TLSH T14685B35163F84215F6F73B7059B966300E7A7CA5AB38C2DF228415AE8EB1EC08D71763
- MD5 SHA1 SHA512 SSDEEP TLSH