d03a8ba81fd62a7b4b9d8e249adce4f5d1243948925cfcad69e6cd024caf2ddc

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_b2f1d66545aa245a69408d3d7ddd2b10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 73KB
Sample260730-kps12svamf
SHA256 d03a8ba81fd62a7b4b9d8e249adce4f5d1243948925cfcad69e6cd024caf2ddc
MD5 b2f1d66545aa245a69408d3d7ddd2b10
SHA1 48d8b6bb05bdb8239d84644ff62ddadea2dc1bb6
SHA512 16b294cc59c17581f382f03d53d97d90d567a4b4fad0d1aab0b3b93ce068d940003470be193dcbfc0ac52c47d1b4642762b6fe6900145d0eecba49c8546867ea
SSDEEP 1536:Om1wCcyp4OH5/PNP4K1d+QXkSofXYVNy4D+jHJGhUXqBsUgTqu:H1sRK1d+QLofXYVNyYqHEUAsUA
TLSH
T161736D2277C48573FA33817448B9C6A1666ABC1236A1454F3E8DB71E4E733829DB631F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
7032	murzuja.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	murzuja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_b2f1d66545aa245a69408d3d7ddd2b10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 7032	4160	2026-07-30_b2f1d66545aa245a69408d3d7ddd2b10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_b2f1d66545aa245a69408d3d7ddd2b10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_b2f1d66545aa245a69408d3d7ddd2b10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

murzuja.exe

Path C:\Users\Admin\AppData\Local\Temp\murzuja.exe
Size 73KB
SHA256 5d3dc3637b2330c5f8392263644406f1603dbd456fc41beed8e2ada52d517379
MD5 19c43a6bf544cf4d91c9d446cf9deb33
SHA1 bc1181ce6c44ae828c1015ad5e0842862ada4995
SHA512 79ec9826cc2c6be19691ae137176af2f0d1de597c0aed53ae9edfbf66a2d2365e85c08b8949c9aa6f4a04db73020c8ce8defa291845d2d5251a5f4f315668aaf
SSDEEP 1536:Om1wCcyp4OH5/PNP4K1d+QXkSofXYVNy4D+jHJGhUXqBsUgTqrK:H1sRK1d+QLofXYVNyYqHEUAsU4
TLSH
T13E736D2277D48573F633817448B9C6A1666ABC123AA1454F3E8DB70E4E733829DB631F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads