171eda557cedf52b4affaafc948728fa3c0a69f7582633be293ef0c247e10b3d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_ba3d2c2b7b610abfa1af012cdc53c3b1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 96KB
Sample260723-hhdlnssgpf
SHA256 171eda557cedf52b4affaafc948728fa3c0a69f7582633be293ef0c247e10b3d
MD5 ba3d2c2b7b610abfa1af012cdc53c3b1
SHA1 5f4519b911555b384860815945410a7ea30071a5
SHA512 03d0dddd757f39e5f1af49af8d178a25eecd0a1dbbd1b2af1b6ced6c0d329ca5f0a4bf63a8b37b2795ca0510676e46c78e447153c28c147dede8fc3e58b3d376
SSDEEP 1536:SP3DgM88ic7AIXw3Psvl+AfSofXGfN19D+2M2GAoUglcsddLtlQRHLSgRhrFfAA:GR8yl+jofXGfN1BnMJUpsddo5
TLSH
T1C2A3D635BFC54572F33786B589F581D6BA7AB8233911580F248A53490C33B92AEF261F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	murzuja.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_ba3d2c2b7b610abfa1af012cdc53c3b1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	murzuja.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2356	3384	2026-07-23_ba3d2c2b7b610abfa1af012cdc53c3b1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_ba3d2c2b7b610abfa1af012cdc53c3b1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_ba3d2c2b7b610abfa1af012cdc53c3b1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

murzuja.exe

Path C:\Users\Admin\AppData\Local\Temp\murzuja.exe
Size 96KB
SHA256 ce9c099fd05205d4fa6b4b9f35babcebdfb577f82899af26c813006bb2dbe417
MD5 62f3bbaa06ceb4adf5831947285cce03
SHA1 909faa6341a85c26987ffd040fa9aa2db9027b4f
SHA512 1d4d719d40a0fd8a2f0a92ec6d3dc26fd53a95eed0825549e59a608fa5b1f725d1c8820b7e0bf88f66e6dc65e0e257b7c961884c068c0d1ac7ecdd89fa7dc7d2
SSDEEP 1536:SP3DgM88ic7AIXw3Psvl+AfSofXGfN19D+2M2GAoUglcsddLtlQRHLSgRhrFfA+:GR8yl+jofXGfN1BnMJUpsddoz
TLSH
T14BA3D6357FC54572F33786B589F581D6BA7AB8233911580F248A53490C33B92AEF261F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download