771268120c128b732e616bdd1905f99e3387dc5061d44bfd3d84146c9a574fee

General

Target
2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 220KB
Sample260810-sn97yaha68
SHA256 771268120c128b732e616bdd1905f99e3387dc5061d44bfd3d84146c9a574fee
MD5 71c648164aad0303248a7fdf35de0dba
SHA1 d6250f18fc1e29181ce8f794a227c916d8f51b63
SHA512 9bd74f4e3e2fad96be24b3d4a2641a82aa5abc4cb09605ff1350c4829fba01faa68fa0d2d0df49400c23a0ec83ac4985da91a0f8c9a907a871f6cfc8be3762c8
SSDEEP 3072:IiwjdmZtcCyPmGoY1Yb2Tbs/GSEdX6Pi7U0SJVnBOyYN8u2r91:IiwjsyPmkYi5SEkJVnB+2
TLSH
T1E6248C06F741CD32D4C200BD2171D772A66E69315B9F90A3B7D91F697B302E29A3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2908	system.exe
4400	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Loads dropped DLL 3 IoCs

pid	Process
4700	Rundll32.exe
4332	Rundll32.exe
4332	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\obhmdhaa.dll	system.exe
File created	C:\Windows\SysWOW64\eosndhaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4532	sc.exe
3576	sc.exe
3824	sc.exe
2616	sc.exe
3048	sc.exe
3208	sc.exe
4984	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1296	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4700	Rundll32.exe
4332	Rundll32.exe
4332	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4932	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2908	4932	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe	88
PID 4932 wrote to memory of 4400	4932	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe	90
PID 4400 wrote to memory of 1296	4400	2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe	91
PID 2908 wrote to memory of 4700	2908	system.exe	92
PID 1296 wrote to memory of 472	1296	cmd.exe	93
PID 4700 wrote to memory of 4396	4700	Rundll32.exe	94
PID 4700 wrote to memory of 3796	4700	Rundll32.exe	95
PID 4700 wrote to memory of 4532	4700	Rundll32.exe	96
PID 4700 wrote to memory of 3576	4700	Rundll32.exe	97
PID 4700 wrote to memory of 3824	4700	Rundll32.exe	101
PID 4700 wrote to memory of 3208	4700	Rundll32.exe	102
PID 4700 wrote to memory of 3048	4700	Rundll32.exe	103
PID 4700 wrote to memory of 2616	4700	Rundll32.exe	104
PID 4700 wrote to memory of 2908	4700	Rundll32.exe	88
PID 4700 wrote to memory of 4400	4700	Rundll32.exe	90
PID 4700 wrote to memory of 4396	4700	Rundll32.exe	94
PID 4700 wrote to memory of 3796	4700	Rundll32.exe	95
PID 4700 wrote to memory of 4532	4700	Rundll32.exe	96
PID 4700 wrote to memory of 3576	4700	Rundll32.exe	97
PID 4396 wrote to memory of 3236	4396	net.exe	110
PID 3796 wrote to memory of 2548	3796	net.exe	111
PID 4700 wrote to memory of 4984	4700	Rundll32.exe	112
PID 2908 wrote to memory of 4332	2908	system.exe	114

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
472	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\obhmdhaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4532
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3576
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3824
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3208
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2616
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4984
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\eosndhaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib -h -s /d /s *.*
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s /d /s *.*
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_71c648164aad0303248a7fdf35de0dba_amadey_elex_nymaim_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 64KB
SHA256 92914013abfd071b0513d366bcaead978dce2f552c9d2853f4ce775604fb841f
MD5 e161d6f5f440c2a03a9459f2edad66e5
SHA1 e814224b0f00b76a3abafa1d6fb6062847f5bc5f
SHA512 f3615f05548148a1767a850ba6db33083f8249e1f9554a6606a1ce4d6cd7b82f66eae6640c8861d44eb374e2bbe21f1571f4570bdc9eca60352ffb82ee5792dd
SSDEEP 1536:ki0HF97X7IsmZ1VfSkB1VsCydxJEfeoY1OR:kiwjdmZtcCyPmGoY1Y
TLSH
T14C538E1778D08D37DA8260B019B19B26E7BBF9700E6196837BAC7DA95F31950CD23347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AC73.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC73.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eosndhaa.dll

Path C:\Windows\SysWOW64\eosndhaa.dll
Size 24KB
SHA256 6e7c04e90d3c42bc9af95eb5b03c60664fc812a62129a578906aa3d9b9be1664
MD5 66ed0210db83ddb4b2ba9128d19fdd2a
SHA1 a512e102bae54b299c90de3f3fb01184ad0bfd2e
SHA512 6fda543bdacecacd6aa1eb66a4b84a9aa49a23f212c4e0c36dcbf725a0739c5843c29465daca248679368057bfa208b67d764e9cd3844ba39a94c7283c5d7de0
SSDEEP 384:deNKXvoxOHye5RizkpgYiAOu86/0WhRR4u20bD0MR9CHom9W50e:deNK/oYyeuAyYN8oMu2GDrCHIie
TLSH
T157B2B3A4FB4EED21E19640B63264EB7A64486930578FB0D3F7C34E5155342E0AA7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obhmdhaa.dll

Path C:\Windows\SysWOW64\obhmdhaa.dll
Size 77KB
SHA256 0018ee5ad65eda4843d24464fc41ecda9ae3e051aab404f3e6c4215940168c21
MD5 02fc7f52c9bc1141c0897c985fea35a6
SHA1 eba3456099c844eaa2b912c5af9ff3329d887b67
SHA512 cd586c85b2652bbcd1a41ff2c4c5fbf06a28791139e9e0306d6b8f934cf4df0ea78dbd1ddbe56cfaf5409767dea9b009f39454abf1c9ee1959f965153811ea7a
SSDEEP 1536:He1LerP4LPg1we6+EX6Pi7U02rd9cqCmh6DY5atOXPQj:HGSEdX6Pi7U0SJV
TLSH
T15B731744F301CD36C9D004BE6261D372751D6A32AB9FA4B377DA1E5AB7302F3A629706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 145KB
SHA256 1ee7203489d481bab20eb0ff992690e17a47c92fe4c03c0cb71ec778b5aeb988
MD5 61f1859980e11a573a23583c8945ff58
SHA1 97aae77f77670c923d22ea1eacc6c1dcef4e51d1
SHA512 7091286a643767f0f18bd995dbd569b8e149102e5b74798837052e412857de3a28654a96c8f4b2f805400cf446193c55b8f0c9a1f47030554f388ac1a9b6042e
SSDEEP 3072:T2Tbs/GSEdX6Pi7U0SJVnBOyYN8u2r91:q5SEkJVnB+2
TLSH
T1F9E35B05F741DD32C4C100BD2175D772651D6A319B9FA0A3B7CA1F6ABB302E2AA3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2908-17-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4932-11-0x0000000000400000-0x0000000000438000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads