9a3494be73ed50f7d5b1e3198cd3c918655f8d1ee8362a35de53eeca49814c11

General

Target
2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 142KB
Sample260801-dfswcswele
SHA256 9a3494be73ed50f7d5b1e3198cd3c918655f8d1ee8362a35de53eeca49814c11
MD5 94a5708a6631232af9ca55342ba67afb
SHA1 eeb77373e43e262f0b30c4327e48ba29b2ee8dc8
SHA512 184f88666923f7be235998e1e6ac17cb04347bd33c76567693b4061003dff852adf0436e2807e60812b6133c11963ce9338839ca83497135a4ca901443b300d4
SSDEEP 3072:VctaH80sZkfLp6O+7U8ncotJVDoXf601GBx:VrpfLEgYcotJVDKc
TLSH
T18BE37B00B721DD36D1C605742169DB72691E66302B8F93A3FBD2175EBE323D1AA3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 3 IoCs

pid	Process
3676	Rundll32.exe
4892	Rundll32.exe
4892	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Rundll32.exe
File opened (read-only)	\??\E:	Rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cfcjdhaa.dll	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\plkkdhaa.dll	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4696	sc.exe
956	sc.exe
4316	sc.exe
696	sc.exe
2544	sc.exe
5836	sc.exe
4512	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5256	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
5256	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
3676	Rundll32.exe
4892	Rundll32.exe
4892	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5256	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 3676	5256	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	88
PID 3676 wrote to memory of 3428	3676	Rundll32.exe	89
PID 3676 wrote to memory of 1652	3676	Rundll32.exe	90
PID 3676 wrote to memory of 956	3676	Rundll32.exe	91
PID 3676 wrote to memory of 4696	3676	Rundll32.exe	92
PID 3676 wrote to memory of 4316	3676	Rundll32.exe	97
PID 3676 wrote to memory of 2544	3676	Rundll32.exe	98
PID 3676 wrote to memory of 696	3676	Rundll32.exe	99
PID 3676 wrote to memory of 5836	3676	Rundll32.exe	100
PID 3676 wrote to memory of 5256	3676	Rundll32.exe	86
PID 3676 wrote to memory of 3428	3676	Rundll32.exe	89
PID 3676 wrote to memory of 1652	3676	Rundll32.exe	90
PID 3676 wrote to memory of 956	3676	Rundll32.exe	91
PID 3676 wrote to memory of 4696	3676	Rundll32.exe	92
PID 1652 wrote to memory of 4312	1652	net.exe	105
PID 3428 wrote to memory of 4392	3428	net.exe	106
PID 3676 wrote to memory of 4512	3676	Rundll32.exe	108
PID 5256 wrote to memory of 4892	5256	2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_94a5708a6631232af9ca55342ba67afb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\cfcjdhaa.dll Exxcute
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:956
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc delete ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc stop 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:696
- - C:\Windows\SysWOW64\sc.exe
    sc delete 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5836
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4512
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\plkkdhaa.dll Exucute
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

A02E.tmp

Path C:\Users\Admin\AppData\Local\Temp\A02E.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfcjdhaa.dll

Path C:\Windows\SysWOW64\cfcjdhaa.dll
Size 76KB
SHA256 9df1adbe900811a8994ebb6b017309210ee38d9e11dd43d0242047d9e048f9c5
MD5 d8825d71f4f42ed2fb9832bc087b6b71
SHA1 39c76e2c9745b295810d13d9c5408206a93974de
SHA512 4d0f135573188b27b1f4345a1cb67956d40370365863c8c36a337f7771b3bfdd4e0ec76338b37439c9849abd02c6f43ae6e1325b9098bcfb0b47bac55ef900f6
SSDEEP 1536:zk28/17BlcI4vLu8+Oq6OcD7U2/ncoYWrd9cqCmh6DY5atOXPQeq:zkfLp6O+7U8ncotJVD
TLSH
T106733A007321DE3AC2D50934619EC677791E06302B9F5773EBA2261EFE727D1A67930A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plkkdhaa.dll

Path C:\Windows\SysWOW64\plkkdhaa.dll
Size 22KB
SHA256 a3f150a622ccf38f8e9e8623cdc4e1a009923dbcfd93e569acf3911bba17aea9
MD5 b5dc82e79797a95985281fc603bc1967
SHA1 ea60d6bea59a4e8ffa16e4de08c3547d364f40b1
SHA512 e4dc9498427b755610178fe19fdd36b71fdd3b161b91777945d7337e93b4c3fc84b65f7efc6caaa5cf9cc86ebefa5e5faa8426c12436ec113858f6627543dfd7
SSDEEP 384:cvqMbAKZOxkyDsVc06AWOQCu09RRUbfQmLMR9CHomi:cRccyo60179UfHqCHC
TLSH
T17AA2E729E74EED71F09250B931B9AE3A640C2931138F50E7F7C34F9556742E1A23AE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5256-4-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/5256-20-0x0000000000E40000-0x0000000000E66000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads