3565af8f7621aa68c6dae2993bbb1e009d0c9b48cb67a3ac6af1bb1c0af0763a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe
Size 113KB
Sample260720-rdxcnaev4t
SHA256 3565af8f7621aa68c6dae2993bbb1e009d0c9b48cb67a3ac6af1bb1c0af0763a
MD5 e563e7bd91ac3c848e61002bfc3c818e
SHA1 b8b49df7ce2cf4caeb99c165c3c8a38e495b3e5d
SHA512 6dbdabada36d4da0d3073e8d8e07bb20119a1216a95ac5c414f77345f39ac7acec59843f7d44b457f61a13301dbd2ffd106141f69c0f9a74771372ff6d83366d
SSDEEP 1536:2/bsMRXzJWXuvo8KzrQWCmWLTYaJWT99hoBR6WfUGOloMcP/B25Vcs:TMR4NrLJ9aI996B4WsBlY25as
TLSH
T1EBB37CC0644F7933DB9293721147A815823AC1A89F2497563FED988F22A72F76B3F531
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe
3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 5152	3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe	80
PID 3036 wrote to memory of 5152	3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe	80
PID 3036 wrote to memory of 5152	3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe	80
PID 3036 wrote to memory of 5152	3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe	80
PID 3036 wrote to memory of 5152	3036	2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5152
- C:\Users\Admin\AppData\Local\Temp\2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-20_e563e7bd91ac3c848e61002bfc3c818e_amadey_elex_redline-stealer_smoke-loader_stop.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads