Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 2.3MB
- Sample260808-nrvjfadc72
- SHA256 6de8b07c1698b2e764f6bf734d00aa1da21466d00f02b0ea866240c84ce4b92b
- MD5 90b3b0417a8c30e2e12ab6ce9edc24ec
- SHA1 abab192335b2f356c3fbef53240b2c69041806fe
- SHA512 8479c8f35a09bf3e8e67276c21ce701da1003238023ae3bb3a487e71b916f01a83c462e3ea3c2bffa53f54e5c09f607a865d3a195971542f9b67718f022a932a
- SSDEEP 24576:/X/ajNHJFzWqiQiqmTJFHDUThX/ajNHJFzWqiQiqmTJFHDUTWdrK:SHJF7LiqCJVsIHJF7LiqCJVsQO
- TLSH T185B51602635240B3D1553474C45ABBA80764AFB52F63E2E7FE54711AFE72BC648332BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4424 2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_90b3b0417a8c30e2e12ab6ce9edc24ec_amadey_elex_nymaim_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 4.4MB
- SHA256 cdceb0e303f5fdc241dfddda50ef2dc92c9f1ec18bc6c994c870392666a02e18
- MD5 d4de6cb25d2ce498402c78c50c518a7d
- SHA1 5a7321939078e300198cd7e3b8a4e4bd92460f1f
- SHA512 f37397ea7d06b0e9895e5179df2b781b82d05858f2233ed88649045d02320e9035af5435f9c4aa6cd7a8302c1ad4808a563a125a543ffd2cec19b991eac37d7f
- SSDEEP 49152:SHJF7LiqCJVsIHJF7LiqCJVsQhCbRquA/m2yL5zbfFiV+XenmE3/zn:Ci1JVs4i1JVsQOoq2VjnmQ
- TLSH T1F7266B05736480B2D1A1A174C456AB56E3707E742F33E6EBAE54720EBE33BC1493B276
- MD5 SHA1 SHA512 SSDEEP TLSH