5d052fc648f4e386ff983233288dc3ef3450171eec13f6325cd9a3b994d14df7

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_6dbc744d3f09860696234503708d41a2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 64.0MB
Sample260730-btt98saa58
SHA256 5d052fc648f4e386ff983233288dc3ef3450171eec13f6325cd9a3b994d14df7
MD5 6dbc744d3f09860696234503708d41a2
SHA1 c3615ac55acbcf495d67bb216495294175640d73
SHA512 7de5a9951c8dc95358acdd322f252c8b312f24dedddecc3a74229fe558a7795d7495005fb4d32a7b39be09fa1f743105c88d6b634592fc3c75864de8a783480c
SSDEEP 1572864:RqGjo8g0mPBUMkb7Px/ieq7oZHlB2yrJ/HSJ5vt:Rs8gHP9Q7xEsFX/yrv
TLSH
T1B2E73379E4019554C83EF331AADA4E73DA3200795872D29F8D1CA8D17EE70E9AB0752F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2832	GLB73AF.tmp

Loads dropped DLL 3 IoCs

pid	Process
2832	GLB73AF.tmp
2832	GLB73AF.tmp
2832	GLB73AF.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLB73AF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLB73AF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_6dbc744d3f09860696234503708d41a2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2832	4100	2026-07-30_6dbc744d3f09860696234503708d41a2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_6dbc744d3f09860696234503708d41a2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_6dbc744d3f09860696234503708d41a2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\GLB73AF.tmp
  C:\Users\Admin\AppData\Local\Temp\GLB73AF.tmp 6656 C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GLB73AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLB73AF.tmp
Size 70KB
SHA256 3ef6e3b71fe1a8b7f01d0a63ffad83f927d3dbca059cb8638405f1762dd33b3d
MD5 53bc7e96cee1787ba3c56508e97869c6
SHA1 b7d81d748d7c0db6a5f72dc7e40ff094eb50991d
SHA512 63bae268f1478ed0a7d0e775bd3c87939ab8d381c47a884453cd0614dc56618a27ebe1e0d3d1c1865afb5bd55b00f2ba3134d3e229286167848e11a3a33a7f18
SSDEEP 1536:bm69v5i/XaUK4jYFpe+rlTq1emWkh6k3Owf:bmohcaR4elTq1emd6C
TLSH
T170639F117884C773C41544B1196AC2A14B7FE8126AA9898BFF881FAF9F705D09B3637F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLC74B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLC74B9.tmp
Size 188KB
SHA256 739105d5981cdb3040a184c28f7d7bfaf0eabf2529fa81f5697cb7c42ba0e784
MD5 b285c45a315f4e85a94962151c5f2b09
SHA1 c0daee3a412678988fa1a9325c52cdca102e1711
SHA512 ed3ea4018fb1bd2859e8ebb74f0ab71f45096b687218ff748f6d581737385cc79b35940a2f6bbc2913d9ddec0902d168b5fd903729fce20ea83922bc4756d7b6
SSDEEP 3072:gz02Vb1SoQgFrCjZJcbZD+vc7xOZRpi6t3nB3Tw7ObZMTrSwQbCH3BSb:gDVJSoQgFejLYZD+vc7xOZRpiS3xyObf
TLSH
T1C7148E197185D037D727003DC877A7728A7DB8600B6E69E3EBD909E45FE16C69E28383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLK7641.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLK7641.tmp
Size 36KB
SHA256 644d8d8e2e83d56b477dbc875412af78e91f6a207a2de6eff1269f1e607ebf97
MD5 d5e6b47c29ce2799fba8091c2c5660c8
SHA1 9c08df034ba69a86c51830a3487feb87c9860d56
SHA512 eb1e281df19c5cdc9b06ef572d1e8adc269210b4d0bc6d37009388de790ae46c945233c8fff45a65426d5bf388aaf01f361b68b4260f5435de0933bd30da0003
SSDEEP 384:IlB+vEr4Ry91G5GkrCiKY4WyWMmqnXDYjESmvmkIKXMoCu+7/U4eLbb:Thy91G5GCCiK1mqXr1jbb
TLSH
T19CF2C716B604C0BAC448063A8C5BDFFA9A72BC117D201A47B3B1FB9F7E31351BD22595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads