Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 13:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe
- Size 1.2MB
- Sample260601-qdpgdae16k
- SHA256 f6f4e23cf56ffe4ae991856e9c497ea5da26328f2e0926a5cbf4c5cd3347a215
- MD5 b95861de260e657e5ef375d497c4b72a
- SHA1 abb28224a0a15726f0341e4cc5341b7c5d8e37d4
- SHA512 05a9d267ef9f7e1e2bb863f40166fdf0407b611e5c79fecc81006a875bc88b9325d5b3e284c4372643a9c9c93b85a6079019542792f462186ee11b86932b0e56
- SSDEEP 6144:0PrGy4T+qJWMiQ14e+sxdETcZPbcLjdU:IrG/SqJb1lb0i
- TLSH T15D45AE81B643D431D5528930CC28F2F91B2ABCF6ED259A4776E83F9FFD711C21A6A211
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
2210
Extracted
Family
-
smokeloader
Version
-
2019
C2
-
http://10022020newfolder1002002131-service1002.space/
-
http://10022020newfolder1002002231-service1002.space/
-
http://10022020newfolder3100231-service1002.space/
-
http://10022020newfolder1002002431-service1002.space/
-
http://10022020newfolder1002002531-service1002.space/
-
http://10022020newfolder33417-01242510022020.space/
-
http://10022020test125831-service1002012510022020.space/
-
http://10022020test136831-service1002012510022020.space/
-
http://10022020test147831-service1002012510022020.space/
-
http://10022020test146831-service1002012510022020.space/
-
http://10022020test134831-service1002012510022020.space/
-
http://10022020est213531-service100201242510022020.ru/
-
http://10022020yes1t3481-service1002012510022020.ru/
-
http://10022020test13561-service1002012510022020.su/
-
http://10022020test14781-service1002012510022020.info/
-
http://10022020test13461-service1002012510022020.net/
-
http://10022020test15671-service1002012510022020.tech/
-
http://10022020test12671-service1002012510022020.online/
-
http://10022020utest1341-service1002012510022020.ru/
-
http://10022020uest71-service100201dom2510022020.ru/
-
http://10022020test61-service1002012510022020.website/
-
http://10022020test51-service1002012510022020.xyz/
-
http://10022020test41-service100201pro2510022020.ru/
-
http://10022020yest31-service100201rus2510022020.ru/
-
http://10022020rest21-service1002012510022020.eu/
-
http://10022020test11-service1002012510022020.press/
-
http://10022020newfolder4561-service1002012510022020.ru/
-
http://10022020rustest213-service1002012510022020.ru/
-
http://10022020test281-service1002012510022020.ru/
-
http://10022020test261-service1002012510022020.space/
-
http://10022020yomtest251-service1002012510022020.ru/
-
http://10022020yirtest231-service1002012510022020.ru/
rc4.i32
rc4.i32
Signatures
- Family: SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3204 Process not Found - Executes dropped EXE 2 IoCs
pid Process 720 cuaewii 4304 cuaewii - Loads dropped DLL 2 IoCs
pid Process 4444 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe 4304 cuaewii - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1252 set thread context of 4444 1252 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe 80 PID 720 set thread context of 4304 720 cuaewii 86 - Program crash 2 IoCs
pid pid_target Process procid_target 1600 4444 WerFault.exe 80 2076 4304 WerFault.exe 86 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cuaewii Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cuaewii Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cuaewii Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cuaewii Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found 3204 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3204 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4444 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe 4304 cuaewii - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found Token: SeShutdownPrivilege 3204 Process not Found Token: SeCreatePagefilePrivilege 3204 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1252 wrote to memory of 4444 1252 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe 80 PID 1252 wrote to memory of 4444 1252 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe 80 PID 1252 wrote to memory of 4444 1252 2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe 80 PID 3204 wrote to memory of 1888 3204 Process not Found PID 720 wrote to memory of 4304 720 cuaewii 86 PID 720 wrote to memory of 4304 720 cuaewii 86 PID 720 wrote to memory of 4304 720 cuaewii 86 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_b95861de260e657e5ef375d497c4b72a_elex_manuscrypt_redline-stealer_rhadamanthys_stealc_stop.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 3963⤵
- Program crash
PID:1600
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4444 -ip 44441⤵PID:2940
-
C:\Users\Admin\AppData\Roaming\cuaewiiC:\Users\Admin\AppData\Roaming\cuaewii1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Roaming\cuaewiiC:\Users\Admin\AppData\Roaming\cuaewii2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 3883⤵
- Program crash
PID:2076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4304 -ip 43041⤵PID:2520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\4DD3.tmp
- Size 1.6MB
- SHA256 35f8d721f246ae3e19d204f9bcab3237448ed906a25bba14e7016e5cdd2fc2ce
- MD5 1cf5669feb127f89f57e8e9d9ac11409
- SHA1 d8aaccbbef08cde0161bfbc0f6b7b1e8a1c43d42
- SHA512 7ebf6cc1a5a0d1ad89666af09bbdd947c02fcb933aeb72c8aff1a378582e38e5c816f806afe87038f10215c3c6c11e50f3226146ba3358e4d6005553cf373b08
- SSDEEP 24576:aVt7gjySvKflMZ3wZq6ElHMvJKIZY7VaZA/rOvSBDSnH+XQk7WqITgR:24yZeBwI/OvJKIZaFCvYYq6qIMR
- TLSH T14685B35163F84215F6F73B7059B966300E7A7CA5AB38C2DF228415AE8EB1EC08D71763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\cuaewii
- Size 1.2MB
- SHA256 f6f4e23cf56ffe4ae991856e9c497ea5da26328f2e0926a5cbf4c5cd3347a215
- MD5 b95861de260e657e5ef375d497c4b72a
- SHA1 abb28224a0a15726f0341e4cc5341b7c5d8e37d4
- SHA512 05a9d267ef9f7e1e2bb863f40166fdf0407b611e5c79fecc81006a875bc88b9325d5b3e284c4372643a9c9c93b85a6079019542792f462186ee11b86932b0e56
- SSDEEP 6144:0PrGy4T+qJWMiQ14e+sxdETcZPbcLjdU:IrG/SqJb1lb0i
- TLSH T15D45AE81B643D431D5528930CC28F2F91B2ABCF6ED259A4776E83F9FFD711C21A6A211
- MD5 SHA1 SHA512 SSDEEP TLSH