Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 85KB
- Sample260810-ezgswaea76
- SHA256 1dcb2830489ebbd6a8a783c507dd0f3017afcb5db85206236cfe9feaede13e7f
- MD5 93c040402c48cca101d5ca8a6f6f45ae
- SHA1 6149d13519a4a9436f3c0f788f1ce152d25a2c5c
- SHA512 750bf4429ab02096d70a69320cb450da17498d4f34288b87edaedebf442425f54bebd4573f1bb25626a9b6127ef8bb983b4d35f7c13e85c1c9ec6c06a80424df
- SSDEEP 1536:WnAkZVcvhXIgA3lh+/dwJyfZFX9hD/k4upEO:cAkZgSzWFuH
- TLSH T1F2833A1A6E93C033F4111D708AA4D5E14BFE7C2335B6A16FFF4406696EF11804E6A7BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5104 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1BEB.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1B0C.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXF4E.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1B9C.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX11B4.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1B8B.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF5F.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX1F0A.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1106.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX1F3A.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX10E6.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1175.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1C2A.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX1F2A.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1B2C.tmp 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 812 wrote to memory of 5104 812 2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0e580ee0.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_93c040402c48cca101d5ca8a6f6f45ae_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 53KB
- SHA256 8a8d788b058502af1893a9b43939c3c75a3cfda3cce2fd68669eb519814cb78d
- MD5 31adeb442f0ad898198304d87bfccfdc
- SHA1 e77b6df8560150dc9c972ee28c8a88c85bc2bfc0
- SHA512 274b6ab545e7103f17f11effcc60b47547b03c8e5b80a3d7c74215496bb081a13811a5675eb3ee0d7d9ab167a8dc496fcbbf6473728805b5f3d50c12481b3368
- SSDEEP 768:rTkpTd9ICFHvo3lVHhvQ/xthGEUJyGOTAqFX9iUQs/kuT2EDcXnpEgvbBG:EXIgA3lh+/dwJyfZFX9hD/k4upEO
- TLSH T1CB336C2677A1C032E46629745D75C2B25B7F78225678C7873B8807BDAF713C09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RCXEE0.tmp
- Size 32KB
- SHA256 10e9a063602b07af1944d1056672140164086c5e3cd9ceddf7c9c54b27d71fdd
- MD5 662870da19661e16091e663d5fca50b6
- SHA1 155b8199e74dca882e1c9f43db4e06cd879bdc4e
- SHA512 5403e95a7c544aeffecb254f08dc2154eebb68cbdbf15f0b913976c3b68f9bceeb48e5b82fac15a1f6ba23909440f8f0f53e7ce7d2ba0b6f5f496de41cc5dba0
- SSDEEP 384:Wn9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW60s:WnLv0SpxeAidabHtydtZlNoV
- TLSH T1ABE2080EAC4BA613F4118C71D7D1A5E99FFE5C2739DB703FEF404A0169E1048849AEB6
- MD5 SHA1 SHA512 SSDEEP TLSH