d845e871eb826347e6a6c5b11110c743637dd0ce624a17f331c98a77be4e27e5

General

Target
2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 36.8MB
Sample260718-c32lcadw3j
SHA256 d845e871eb826347e6a6c5b11110c743637dd0ce624a17f331c98a77be4e27e5
MD5 a88663f22ca5119e605f8db18d47dd47
SHA1 d4a0a32418d03ca26ab4d4b7092eb41117d0f040
SHA512 1f02667ae9bb4b8308a09eaa1ba54fd2bb62e8adc4cf707b2c8dc5e8b87f127d0a400bdf0fabbe57c28149be8cdf7369c4c59f68b79e4d6028f6fa4c48a855b1
SSDEEP 786432:W3wbV4BEBGNTrVBTIWrrDeYbsb+Fe4WshZP7+AxOFbjx9cYaL2aghJ4c7GPpBzr:WgbOBOErrqVb+Fe4WW56AxOFb99cYaLl
TLSH
T11E87334279E1D8B6D498013149F047EA6B366EA5AF60C6EB57933F9F4CF02D09338789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c536-22.dat	UPX
behavioral2/files/0x000d00000001c537-29.dat	UPX
behavioral2/memory/864-35-0x0000000000CF0000-0x00000000010D8000-memory.dmp	UPX
behavioral2/memory/864-45-0x0000000000CF0000-0x00000000010D8000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
4736	setup.exe
864	irsetup.exe

Loads dropped DLL 6 IoCs

pid	Process
4312	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
864	irsetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c537-29.dat	upx
behavioral2/memory/864-35-0x0000000000CF0000-0x00000000010D8000-memory.dmp	upx
behavioral2/memory/864-45-0x0000000000CF0000-0x00000000010D8000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tweaking.com - Windows Repair Setup Log.txt	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
864	irsetup.exe
864	irsetup.exe
864	irsetup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4736	4312	2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4736 wrote to memory of 864	4736	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_a88663f22ca5119e605f8db18d47dd47_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\setup.exe
  C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\setup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1792258 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\setup.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1875162379-3804078649-638427191-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 433b75967a2d011cf5b2ee68202d8e409b1fc11f94661df5bd170d1cd638192e
MD5 282081271a2b528e76d739bd4f404c85
SHA1 1f97c4c7cd34d44d2503c506dd0503c567add7ea
SHA512 85f408bf739e212c1a7e22c50509c24b5f0071f9884e665fac3ca5576494316a7d7fd2e6b0bf78f9c540a4cf9752a5ffca746f050e41ccccdc6e032693e80d7e
SSDEEP 24576:VzC25QqJNUXIaRks5D8hYm0bXixegr1+sIG6byK7ki6NrdH7iVqPGFHQZ+:5C2lJmXbj5DIwbQea1LPEyK7rHqGVQ
TLSH
T13B553393C32F4476E0CA0BB258AA8587BF3F3C24F968B05632EDBBD35D561228677544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 322KB
SHA256 769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45
MD5 c3f5f4a1fb69b5889f0bbb313cf6017f
SHA1 e4f592cfbd62a3c3caf27177ccea5a77afa649bb
SHA512 e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab
SSDEEP 6144:+kn2LG5bwf92+0HiDhAqUS0aMkhwfDRAOj+JzOg7Fp:72x2cdUhZcIDR8xhp
TLSH
T18E64AE03B293C072D5A500B90569D7BA4E7A797157B6C4F7EBD01AAD8E203E0A73734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\inetc.dll
Size 20KB
SHA256 5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
MD5 c498ae64b4971132bba676873978de1e
SHA1 92e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA512 8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
SSDEEP 384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG
TLSH
T17E921A01AF5596F3D3A90930F569375386EAAE742530A48767F71FCD186A283FA34703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\setup.exe
Size 36.7MB
SHA256 e6f084c5c967385daa43122f49c9756c8141669989793910bf369841a8df7c4f
MD5 9b8bf53844c0fee29a125bc592b22291
SHA1 88e81bb3cbdb2d41b8bca500ab4d2bdb89cbbe8d
SHA512 f83ce63cdd332b537552555940a292a85d1b67f34ffcfd51196c322da2152afc6838ba84f2d150e0e48efbf8936b4497e220971c595b402f83f281c494631bc8
SSDEEP 786432:93wbV4BEBGNTrVBTIWrrDeYbsb+Fe4WshZP7+AxOFbjx9cYaL2aghJ4c7GPpBzU:9gbOBOErrqVb+Fe4WW56AxOFb99cYaLm
TLSH
T1FC87334265F1D9BAD19801720AF047EB6F356AA5AF70C5EB97933F5A0CE01D0A374BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-35-0x0000000000CF0000-0x00000000010D8000-memory.dmp

Download

memory/864-45-0x0000000000CF0000-0x00000000010D8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads