Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 85KB
- Sample260820-hpg8faca29
- SHA256 d01efde540fddcfb04fdf56897aa6fe65f73b9c6ac4645f3d82aa7f5e49e22d2
- MD5 9a0fa230ded2783f36dd8f2bef16a7a6
- SHA1 ccadda83cf4de2adddbf835a70d93001ba60c4c0
- SHA512 c96a0d268bd51e271a6bcc7732c3c13f9e88218416a0b84e3327dbae0189fe74909ca4aeaedb3fb2c1e73aa278028680e69a127703282cf16ca5d40a6eae0a0c
- SSDEEP 1536:WnAkZV1XIgA3lh+/dwJyfZFX9hD/k4upEO:cAkZhSzWFuH
- TLSH T1CF833A1A6E93D033F4515C708AA0D5E14FFE7C2336B6A16FFF4406696EB01808969BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3328 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3CCD.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3C7E.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3C1F.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX400A.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX2F46.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3BCF.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX404A.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3302.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX403A.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3189.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX2EE7.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3BAF.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX3341.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX31A9.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3BFF.tmp 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 808 wrote to memory of 3328 808 2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0e592e4a.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_9a0fa230ded2783f36dd8f2bef16a7a6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 53KB
- SHA256 8a8d788b058502af1893a9b43939c3c75a3cfda3cce2fd68669eb519814cb78d
- MD5 31adeb442f0ad898198304d87bfccfdc
- SHA1 e77b6df8560150dc9c972ee28c8a88c85bc2bfc0
- SHA512 274b6ab545e7103f17f11effcc60b47547b03c8e5b80a3d7c74215496bb081a13811a5675eb3ee0d7d9ab167a8dc496fcbbf6473728805b5f3d50c12481b3368
- SSDEEP 768:rTkpTd9ICFHvo3lVHhvQ/xthGEUJyGOTAqFX9iUQs/kuT2EDcXnpEgvbBG:EXIgA3lh+/dwJyfZFX9hD/k4upEO
- TLSH T1CB336C2677A1C032E46629745D75C2B25B7F78225678C7873B8807BDAF713C09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RCX2E4A.tmp
- Size 32KB
- SHA256 7ac88a92f599d888b277c950953b16fd1c18a81ad7076b9f31bd14aa9a0034ce
- MD5 fbf0b761f6f506c7a11e49ebf1774b18
- SHA1 d272b7db4d100529bc34f2015464520a7487f804
- SHA512 11acc85d37bdc17eb7152b9abad9e6a5dc1b81d9e9200021ef4c5121bcd4be1a2dcc41f95eb1506a5ac65af95b4427e12e2addd0b1de75d2f3bc5faf36353cd8
- SSDEEP 384:Wn9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6us:WnLv0SpxeAidabHtydtZlNo/
- TLSH T15AE2080EAC4BA613F4118C71D7D1A5E99FFE5C2739DB703FEF404A0169E1048849AEB6
- MD5 SHA1 SHA512 SSDEEP TLSH