04aa94716cac49302356876c7172a547ed38a44a51c2f2630678523033cb2158

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_43e6f705f3c8b9dafd6bc3ceeec59948_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 92KB
Sample260804-pekn5sek7v
SHA256 04aa94716cac49302356876c7172a547ed38a44a51c2f2630678523033cb2158
MD5 43e6f705f3c8b9dafd6bc3ceeec59948
SHA1 d049fb677c1da5d46990d98c0c2cd4d0394de3bc
SHA512 25afb3e193ecb8c538d2c9ed0d1b6be62a328506ad3ca339c57ea8922205fdae259a6f6613e09f42adda521a2a9150f9562a67e0c1df0ccfc6a8fb5c557cc437
SSDEEP 1536:SP3DgM88ic7AIXw3Psvl+AfSofXGfN19D+2M2GAoUglcsddLtlQRHLS6JJ:GR8yl+jofXGfN1BnMJUpsddC
TLSH
T1A59307357BC54572F33796B489F681D2BA7AB8233911580F248A53490D33B52AEF271F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3684	murzuja.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_43e6f705f3c8b9dafd6bc3ceeec59948_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	murzuja.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 3684	6124	2026-08-03_43e6f705f3c8b9dafd6bc3ceeec59948_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_43e6f705f3c8b9dafd6bc3ceeec59948_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_43e6f705f3c8b9dafd6bc3ceeec59948_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

murzuja.exe

Path C:\Users\Admin\AppData\Local\Temp\murzuja.exe
Size 92KB
SHA256 5594475a2d79c6d86db861121deb034e9253e96f4434d8e2b93f6a54cab1a896
MD5 e06093d68c069aa5863e264d22507894
SHA1 4ca071947bb60c3baa31f51712f33b294a8cf398
SHA512 553697cf3b8113e886f22f6fcd0c3e4ef5318545b924f0e6393d58d3ec0dc4927c62e62ef4acab0caa2b30fc628e2f4955263646fc6188d203bff44565dfcad0
SSDEEP 1536:SP3DgM88ic7AIXw3Psvl+AfSofXGfN19D+2M2GAoUglcsddLtlQRHLS6J7:GR8yl+jofXGfN1BnMJUpsdd8
TLSH
T1AB9307357BC54572F33796B489F681D2BA7AB8233911580F248A53490D33B52AEF271F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads