9a3494be73ed50f7d5b1e3198cd3c918655f8d1ee8362a35de53eeca49814c11

General

Target
2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 142KB
Sample260801-dfswcswele
SHA256 9a3494be73ed50f7d5b1e3198cd3c918655f8d1ee8362a35de53eeca49814c11
MD5 94a5708a6631232af9ca55342ba67afb
SHA1 eeb77373e43e262f0b30c4327e48ba29b2ee8dc8
SHA512 184f88666923f7be235998e1e6ac17cb04347bd33c76567693b4061003dff852adf0436e2807e60812b6133c11963ce9338839ca83497135a4ca901443b300d4
SSDEEP 3072:VctaH80sZkfLp6O+7U8ncotJVDoXf601GBx:VrpfLEgYcotJVDKc
TLSH
T18BE37B00B721DD36D1C605742169DB72691E66302B8F93A3FBD2175EBE323D1AA3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002455f-16.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3364	Rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 3 IoCs

pid	Process
3280	Rundll32.exe
3364	Rundll32.exe
3364	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xjfrugaa.dll	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\ogmsvgaa.dll	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe
1732	sc.exe
712	sc.exe
2984	sc.exe
3760	sc.exe
1100	sc.exe
1792	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4800	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
4800	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3280	Rundll32.exe
3364	Rundll32.exe
3364	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4800	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3280	4800	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	85
PID 3280 wrote to memory of 2956	3280	Rundll32.exe	86
PID 3280 wrote to memory of 1340	3280	Rundll32.exe	87
PID 3280 wrote to memory of 1792	3280	Rundll32.exe	88
PID 3280 wrote to memory of 4948	3280	Rundll32.exe	89
PID 3280 wrote to memory of 3760	3280	Rundll32.exe	91
PID 3280 wrote to memory of 2984	3280	Rundll32.exe	92
PID 3280 wrote to memory of 712	3280	Rundll32.exe	93
PID 3280 wrote to memory of 1732	3280	Rundll32.exe	94
PID 3280 wrote to memory of 4800	3280	Rundll32.exe	84
PID 3280 wrote to memory of 2956	3280	Rundll32.exe	86
PID 3280 wrote to memory of 1340	3280	Rundll32.exe	87
PID 2956 wrote to memory of 4104	2956	net.exe	102
PID 1340 wrote to memory of 2612	1340	net.exe	103
PID 3280 wrote to memory of 1100	3280	Rundll32.exe	104
PID 4800 wrote to memory of 3364	4800	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\xjfrugaa.dll Exxcute
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:4104
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1792
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\Windows\SysWOW64\sc.exe
    sc stop ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc delete ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2984
- - C:\Windows\SysWOW64\sc.exe
    sc stop 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:712
- - C:\Windows\SysWOW64\sc.exe
    sc delete 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1100
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\ogmsvgaa.dll Exucute
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

A3CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\A3CD.tmp
Size 4.3MB
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
TLSH
T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ogmsvgaa.dll

Path C:\Windows\SysWOW64\ogmsvgaa.dll
Size 22KB
SHA256 a3f150a622ccf38f8e9e8623cdc4e1a009923dbcfd93e569acf3911bba17aea9
MD5 b5dc82e79797a95985281fc603bc1967
SHA1 ea60d6bea59a4e8ffa16e4de08c3547d364f40b1
SHA512 e4dc9498427b755610178fe19fdd36b71fdd3b161b91777945d7337e93b4c3fc84b65f7efc6caaa5cf9cc86ebefa5e5faa8426c12436ec113858f6627543dfd7
SSDEEP 384:cvqMbAKZOxkyDsVc06AWOQCu09RRUbfQmLMR9CHomi:cRccyo60179UfHqCHC
TLSH
T17AA2E729E74EED71F09250B931B9AE3A640C2931138F50E7F7C34F9556742E1A23AE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjfrugaa.dll

Path C:\Windows\SysWOW64\xjfrugaa.dll
Size 76KB
SHA256 9df1adbe900811a8994ebb6b017309210ee38d9e11dd43d0242047d9e048f9c5
MD5 d8825d71f4f42ed2fb9832bc087b6b71
SHA1 39c76e2c9745b295810d13d9c5408206a93974de
SHA512 4d0f135573188b27b1f4345a1cb67956d40370365863c8c36a337f7771b3bfdd4e0ec76338b37439c9849abd02c6f43ae6e1325b9098bcfb0b47bac55ef900f6
SSDEEP 1536:zk28/17BlcI4vLu8+Oq6OcD7U2/ncoYWrd9cqCmh6DY5atOXPQeq:zkfLp6O+7U8ncotJVD
TLSH
T106733A007321DE3AC2D50934619EC677791E06302B9F5773EBA2261EFE727D1A67930A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4800-4-0x0000000001210000-0x0000000001211000-memory.dmp

Download

memory/4800-19-0x0000000000270000-0x0000000000296000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads