b271558c48991f1562d4c94a63ff7ed2b8c1055ed949d28094558d56676c26bc

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_5370e2af2c3412b197e004c1f268e3e1_amadey_elex_redline-stealer_smoke-loader_stealc_tofsee.exe
Size 5.4MB
Sample260806-am335azble
SHA256 b271558c48991f1562d4c94a63ff7ed2b8c1055ed949d28094558d56676c26bc
MD5 5370e2af2c3412b197e004c1f268e3e1
SHA1 5f8ae59acbf0825aa9156cc464bf8912c6aee76c
SHA512 55702890b675e09ae016ce3b261768ab107a4bff11aff088773779496a752278b1776b9a18f2902d704f3984cd480bad2eb76bfb32cfd656b3cf050174c0083f
SSDEEP 98304:uL3sJ/LXALTlttLW5bKN4VanOEH3/ujGc2R9ZcMd3r4jR640s2t2tkgjR:G8J/LXALhttq5bKyV/EH3/ujGrxd4j4q
TLSH
T19D46331162A18232D5A35972CDD8FAB57D347E322030D06FFF54AF781EE43E464A6726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3532	Setup.exe

Loads dropped DLL 5 IoCs

pid	Process
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_5370e2af2c3412b197e004c1f268e3e1_amadey_elex_redline-stealer_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe
3532	Setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3532	2352	2026-08-05_5370e2af2c3412b197e004c1f268e3e1_amadey_elex_redline-stealer_smoke-loader_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_5370e2af2c3412b197e004c1f268e3e1_amadey_elex_redline-stealer_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_5370e2af2c3412b197e004c1f268e3e1_amadey_elex_redline-stealer_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\170d4199584f88714b9e3f2e31e6bcc8\Setup.exe
  C:\170d4199584f88714b9e3f2e31e6bcc8\\Setup.exe /x86 /x64 /lcid 3082 /lpredist
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\170d4199584f88714b9e3f2e31e6bcc8\1033\LocalizedData.xml
Size 80KB
SHA256 680ef849e3c03088c692f65ccd1bd88c5843077be4256dca61d4aed671927027
MD5 64767bc621a1e7340b06ce7c3b824948
SHA1 e2c001e6a84d9659e64ddb4952d061c159f0cee5
SHA512 079653668a6e82429863c52c92d3e94b6e8bf88b2e27006873dd68d1a1bd18246903946f0554d46931d501d3eed682d48608b50606f00c46b5ee50f9f293a8c7
SSDEEP 384:40x89tJKVQVfVjV2vjaCS8etgcbFT/4Se8NqJpR+enRROu5aeJInO/yJakC65qWA:+/4STqyJiT
TLSH
T1F7837E11AFFE2258F1BBAB14BEB710940EB7BD915C39C11D0099188E8A77F858D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\170d4199584f88714b9e3f2e31e6bcc8\3082\LocalizedData.xml
Size 83KB
SHA256 1e5c7e0864f2ad94eff1767762788561ed7b50046f93739c8c3db9aef6edd316
MD5 a769c0738a80968cc66420603e59396a
SHA1 de4ec8a0fe314c6b55b6fbc2595b5279551c519a
SHA512 620a9873b8401d07356d14e75b495618a8599763368282c3b7828c7fc41b31b0463a263f83b1c2f57d53bee4ff53ae29f72b05c5f3934f6a8df21b834dd10305
SSDEEP 384:4El0PfH7g2HbWPD66KUsJ7UUMYLCPex7UM/I9aXdoBchU7aF/6JD1NDoAjJuL4iJ:R/sC2VgZN08Jtikin
TLSH
T152837E11AEFA2218F1FBBB05BEB710944EB7BD919C35C11D0059298E4A77F848E25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupResources.dll

Path C:\170d4199584f88714b9e3f2e31e6bcc8\3082\SetupResources.dll
Size 23KB
SHA256 38de881b12c865d672121977bc8ed9b74cbcf53d0b90f63a32fa90f57000ea2b
MD5 4294a2c33e46a14f3f0e2814fe618a8e
SHA1 0b22fc7bdd14c7984942f3967ef5a6dff1d4d950
SHA512 217b69ee2c383350183538e8252d4e4ac644176dee9d5324814b54aa856d913aad6205bac73b2d50a1e10e6b81ad7e14f204fe5a2e3644413d5586f0f9e730e1
SSDEEP 384:QLhQznmpBbYOqMpjBmWeeWkmWkeWmKD/HRN7Y6KwmEy4lGswz:QUnmjHFwdmKDvY6fy5
TLSH
T15BB23140A7FC5606F5F36F30A9B586665E3EBD929C38C11E1650A29E1CB1F80DE24B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\170d4199584f88714b9e3f2e31e6bcc8\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\170d4199584f88714b9e3f2e31e6bcc8\ParameterInfo.xml
Size 1.2MB
SHA256 2968a1bb0d6771a1064cb4a5c0f926edffd38edb0ff8bbd49ad3034a715a8da5
MD5 72939549fdb940d6f21e851466cbab10
SHA1 57bc20b038cdc37d44ae63d8bf33f772c6c9777a
SHA512 9280b4a8e8650dfdf732ff547c499aa750cd39fa2b326462d494fcd2e912b9f451572b0b3b0f6bf2797cf18dfe7b01cbbf4554d7941e91c38b051b5968f5ceab
SSDEEP 1536:erg5XjfEgyHZgSU3qZgLZgSy3qZgzZgSx3qZgWIl:eIIl
TLSH
T19745BE1223FA0304B3B72E256AF188AA897B3892DC34C75D405D558E97F3E94CA72F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\170d4199584f88714b9e3f2e31e6bcc8\Setup.exe
Size 80KB
SHA256 622ffbd06c57f0ee5e72f58bbab05780153b9cc8918b784597d7f141597e7f29
MD5 5b378d6133955269f9ff9571756e68be
SHA1 6ddc7a4179e092e9e7c5815b87df3e5e6a2b557a
SHA512 441644895081905d9edc8c8c7ea9514e94390b89e94b5e94a34080c9efa382e3ff5d6edaea9fe03b7d8e1fcbc62b8e656e638d55940c4408046fa2c7ebc727f0
SSDEEP 1536:Cv8hgX1PdzaodhYSyyyygPotWZnqxMQP8ZOs0Jmfa9M+KvZ:Cv8hiVd1ZyyyygPo4/gBMfGRa
TLSH
T12F838E01B6A0C476E466153048B7CAF65E3EBD53ADB0415F33887B6F1FB23C1A928766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\170d4199584f88714b9e3f2e31e6bcc8\SetupEngine.dll
Size 859KB
SHA256 80d286407891cd55a6ee0822a9ba85ff9f1ca57e0d71a78049729276ea5f4d38
MD5 62f60fbb153615f0f9854566462afffa
SHA1 b76ac946ae61ef577b12e0165f1ee39c79e05f40
SHA512 718a5b42c7796eb2b14a26226f2de60bd804960c7c756baf44001d2a7df8faa463deccf9f30a4671c86a2110c225bd4ffad1343ef71a09b471da4132ae7fae19
SSDEEP 24576:7G2ynlYATHyxguvuuWysO60pG/I4cvnx9/0d9yoe:7G2ynlYATc7G0pG/ILn/y9yoe
TLSH
T191155C236FF9C075F2FF1731B936575A6AB6F9A29830C91F62C05A1D1E30A11D924B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.dll

Path C:\170d4199584f88714b9e3f2e31e6bcc8\SetupUi.dll
Size 306KB
SHA256 30a7deaed10de841c0854fa4d251dad8647efc659c17fa55ae6909d9f09424cf
MD5 a21e558adec4253054a7a2816863bfc0
SHA1 5b2d46d183fd3b23e3921f9682c209578eb4dd3c
SHA512 37d7f0edc9354479d664b3262df944ffc2402b130c6cbf384be6491c68afa0a068b95e42404756298c8f7a420efc252b4f8fe645d7a6f3a20880f989a347cfaf
SSDEEP 6144:NJhJnJE9EC/5kXAcVOT1ednAi2QeAN7aY5S:NL1JE9EC/59/T1ednA5WaY5S
TLSH
T111645C227BE58075C1EF1730BA2AD7AC45BAF1B258F0D10BBFD42B2E4E736519924B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.xsd

Path C:\170d4199584f88714b9e3f2e31e6bcc8\SetupUi.xsd
Size 31KB
SHA256 aaf8cb1a9af89d250cbc0893a172e2c406043b1f81a211cb93604f165b051848
MD5 a9f6a028e93f3f6822eb900ec3fda7ad
SHA1 8ff2e8f36d690a687233dbd2e72d98e16e7ef249
SHA512 1c51392c334aea17a25b20390cd4e7e99aa6373e2c2b97e7304cf7ec1a16679051a41e124c7bc890b02b890d4044b576b666ef50d06671f7636e4701970e8ddc
SSDEEP 768:hlzLm8eYhsLP8s05GFaAMET/chT+cxcW8G2P4oeTMC:lwchT+cxcDm
TLSH
T1E7E227C631C1CA001B374832AD223B0DFED5A57382D43D61B5DCA637BB76AC62967279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplashScreen.bmp

Path C:\170d4199584f88714b9e3f2e31e6bcc8\SplashScreen.bmp
Size 117KB
SHA256 b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7
MD5 bc32088bfaa1c76ba4b56639a2dec592
SHA1 84b47aa37bda0f4cd196bd5f4bd6926a594c5f82
SHA512 4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830
SSDEEP 384:pu66qlxe0UqtcSiS2gLsd5xfAg+zqFv4t:LP
TLSH
T13FC3EF9C27BF054AE63AAF9A352546441B1EAE9437E03B8F5D3732CAB173341D788285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Strings.xml

Path C:\170d4199584f88714b9e3f2e31e6bcc8\Strings.xml
Size 13KB
SHA256 2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
MD5 8a28b474f4849bee7354ba4c74087cea
SHA1 c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA512 a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
SSDEEP 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
TLSH
T1B352834376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\170d4199584f88714b9e3f2e31e6bcc8\UiInfo.xml
Size 35KB
SHA256 8f7847cfc9ec70b6758f6fbe9b98809ca7bf8ecb25bf9b3a8e7e052b83dfa94b
MD5 8ace169bf65675c089e0327d5b1f7437
SHA1 43646e29c878f58ac4b5d7c192d11b3becd9e9f6
SHA512 3e98f8351e96bab4b8cecf93e590c722233d119d7cec76445a0b170f69de647bd65eafeafecc8888573e986b3f80403480728c7a1e014961fbd60dc169ca5db7
SSDEEP 768:24URHd5vESguJQvFQXvDINJh6FmhPsrVsG8t+p3879km2VG9GMGNGTDKvefkfub:24URHd5vEQYQLIN/6FmhPsrVsG8t+p3+
TLSH
T191F216575BEB0118E2F6AA4D69B304705F1B7E45083AD13C04EC394DEFE7E6289A07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

print.ico

Path C:\170d4199584f88714b9e3f2e31e6bcc8\graphics\print.ico
Size 123KB
SHA256 d80ffeb020927f047c11fc4d9f34f985e0c7e5dfea9fb23f2bc134874070e4e6
MD5 d39bad9dda7b91613cb29b6bd55f0901
SHA1 6d079df41e31fbc836922c19c5be1a7fc38ac54e
SHA512 fad8cb2b9007a7240421fbc5d621c3092d742417c60e8bb248e2baa698dcade7ca54b24452936c99232436d92876e9184eaf79d748c96aa1fe8b29b0e384eb82
SSDEEP 192:ly3ul6MeeS80xxb11yXXVzzzzzlzTTTbt/Pu:lj6MeeSXxxb11yXXVzzzzzlzTTTbt/Pu
TLSH
T191C324636ADE7DD6D0B866B13B7783D1C70EEE058922D02EA2D4366AD17D5037A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

save.ico

Path C:\170d4199584f88714b9e3f2e31e6bcc8\graphics\save.ico
Size 123KB
SHA256 1372c7f132595ddad210c617e44fedff7a990a9e8974cc534ca80d897dd15abd
MD5 c66bbe8f84496ef85f7af6bed5212cec
SHA1 1e4eab9cc728916a8b1c508f5ac8ae38bb4e7bf1
SHA512 5dabf65ec026d8884e1d80dcdacb848c1043ef62c9ebd919136794b23be0deb3f7f1acdff5a4b25a53424772b32bd6f91ba1bd8c5cf686c41477dd65cb478187
SSDEEP 192:cICfR9iBLLLLLLiii1dkx2Xwi+XI7b6ZZZZZZZZZZGGGGys7v5Z7vvvvvvvvvvwF:H2R9iJJi56ZZZZZZZZZZGGGGyHIIIhh0
TLSH
T1BEC3BE07AAEDBEDBD085A271FB3982B1DEE0ED1D4721404E76F9A666E471E1331020DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ico

Path C:\170d4199584f88714b9e3f2e31e6bcc8\graphics\setup.ico
Size 123KB
SHA256 a0c7b4b17a69775e1d94123dfceec824744901d55b463ba9dca9301088f12ea5
MD5 6125f32aa97772afdff2649bd403419b
SHA1 d84da82373b599aed496e0d18901e3affb6cfaca
SHA512 c4bdcd72fa4f2571c505fdb0adc69f7911012b6bdeb422dca64f79f7cc1286142e51b8d03b410735cd2bd7bc7c044c231a3a31775c8e971270beb4763247850f
SSDEEP 192:+7yhu1uz//TAAA555AAAAAr99899AubBqj:oX1uz//TAAA555AAAAAr998991bBy
TLSH
T1F3C3122366DEBDDAC4B467B03B77C3D5C71EEE554922D12EA2C0262A917E0437A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warn.ico

Path C:\170d4199584f88714b9e3f2e31e6bcc8\graphics\warn.ico
Size 194KB
SHA256 4bb9ea033f4e93dbf42fc74e6faf94fe8b777a34836f7d537436cbe409fd743f
MD5 c8824ea3ce0a54ff1e89f8a296b4e64b
SHA1 333feb78e9bb088650ce90dea0f0ccc57d54a803
SHA512 c40e40e0cb2aaa7cf7cccbe29ca4530ff0e0a4de9a7328996305db6dfd6994cbe085fab7b8f666bbd3d1efd95406ea26b1376aa81908ace60dc131a4e9c32d40
SSDEEP 1536:cpUNHIL4Oj0qwL2IupGF8yJtJFFhxGgX/3/HRVq:8mHILxnDIiGFxG4s
TLSH
T12D1418526E2EBFC5F548B231D839C1B00910EE7948AA966B35F67E8B39772237431F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\170d4199584f88714b9e3f2e31e6bcc8\sqmapi.dll
Size 223KB
SHA256 048d51885874d62952e150d69489bcfb643a5131ce8b70a49f10dfb34832702c
MD5 0c0e41efeec8e4e78b43d7812857269a
SHA1 846033946013f959e29cd27ff3f0eaa17cb9e33f
SHA512 e11da01852a92833c1632e121a2f2b6588b58f4f2166339a28dd02dad6af231a2260a7e5fc92e415d05aa65b71e8bbda065e82a2db49bb94b6cf2fe82b646c28
SSDEEP 3072:dl5e8m9Z5G6ZUMIiaQVedGGEc6SYm8X/UvHFupHIjNNlMi/fbtcICcu0b9+x0o/N:WG6ZUon6GVSYmnGHEvlMMac59+xfbZ
TLSH
T1372419D1E1F68071D3D2133072592377E9FAA92F2DD8BE8B1380E7573830982D66975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HFI5A3D.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI5A3D.tmp.html
Size 17KB
SHA256 d4ef934002d96905b6a5dd7bc042f2830310b25a9e99be09ec7d00ad24bf8dd2
MD5 a69a1355d9131e8160f9b46cc7a6687e
SHA1 b73b3ba3f071be6791169d89e7da45bd53c9fa4c
SHA512 f2ab09e022878bb9de0a9d087e3271bff752bd45b8f67ea8d8e583b461e87a82dd4aa1f0607a1a78c6c3080ef04149c5f2e16ca6ce2cf6fdfce0c40926bc9814
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjahg:fdsOT01KcBUFJFEWUxFzvHGS
TLSH
T1C782595326E84244A1B6BF49AFB600750B79BD45AC3CCE7D16A0591E49E3E04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3532-106-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Download

memory/3532-111-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Download