Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 85KB
- Sample260825-ey2fwsfh45
- SHA256 019ac906c14bd7d63dcafd2ba416b8df61edc535111394e0027fd5f4e2615093
- MD5 adb31e6d433adb3c6da6efbf3ac49db2
- SHA1 556e1b045e04ced2ecf32faa82618e8646595ba8
- SHA512 468118f02f055c5507de3599006d75931b304984dedcb892100e59c9b22dca849bcde4a407c9c054b81854c39199ce9bcfd6fc3890071f278f471ded48f8cbd1
- SSDEEP 1536:WnAkZV6XIgA3lh+/dwJyfZFX9hD/k4upEO:cAkZ4SzWFuH
- TLSH T1B58329197993C133F4111D708AA191E14FBE7C2376FAA16FFF4406696EB01804EAA7B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5244 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA5E3.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXAA3E.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXAA5F.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9A64.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX9E6F.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA623.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXAA1E.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA5C3.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX9A63.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9BEB.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA692.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9C89.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA6D1.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9C0B.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA633.tmp 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4348 wrote to memory of 5244 4348 2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5244
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.6MB
- SHA256 d2dd7fb4b5c5526a8de9fadd3ba6c07d2b16174297b60633fc1de01f8a6650e9
- MD5 709e423869164da5f44aea8094205c8d
- SHA1 1fe6db96407ad2a7d9d555ec110de13c66521349
- SHA512 514d1cdd4ac2627bd2dab70edc2841fbed80b917330598fff6a249ce8c188b0a870d9b98279f7eaee98261708cbb2014e7d00595943a433e3da2154cf82c0820
- SSDEEP 49152:bX6YRJJudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:bxbijnUdYd+RaAj
- TLSH T1FB264803B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e599968.tmp
- Size 2.8MB
- SHA256 0a7a6cd0fa18c4c780138dd89a916348e59b81e29c67f9304aaddb3b283a6469
- MD5 f1bfd7c339917ab8eaa59fa055287188
- SHA1 7d693a18902723a579d876b4966db5596639af25
- SHA512 7ad7c8d601cb7ebf33115e879f1fd11e122d905bca8a0612e5822a0031f67d1e46a7bd8207b7df0edeb5c74e913fddbc7cf87fb4ddf44823910495b5affbcbd6
- SSDEEP 49152:8Y2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:8bOjjst4bOjjsts
- TLSH T1CBD57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e599968.tmp
- Size 32KB
- SHA256 afc9733b3845f933fd83813ee74777936714d3ebef6b6fe8cdae79e1e723eca5
- MD5 b32fbd7a82c5243c9465c78f7b9cbaa2
- SHA1 b467165f2d6f8d6a45e7ad73fd7d1626a3ebadbd
- SHA512 410e94cbddd7d5a6d6d04f74b1794f48cdf66b7b9167a104045100f2126aa6a8accea846f796ab607dfe481ef5ea35a7bd210a4a53b3001a8476ada854993b70
- SSDEEP 384:Wn9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6/s:WnLv0SpxeAidabHtydtZlNoA
- TLSH T17AE2080EAC4BA613F4118C71D7D1A5E99FFE5C2739DB703FEF404A0169E1088849AEB6
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-24_adb31e6d433adb3c6da6efbf3ac49db2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 53KB
- SHA256 8a8d788b058502af1893a9b43939c3c75a3cfda3cce2fd68669eb519814cb78d
- MD5 31adeb442f0ad898198304d87bfccfdc
- SHA1 e77b6df8560150dc9c972ee28c8a88c85bc2bfc0
- SHA512 274b6ab545e7103f17f11effcc60b47547b03c8e5b80a3d7c74215496bb081a13811a5675eb3ee0d7d9ab167a8dc496fcbbf6473728805b5f3d50c12481b3368
- SSDEEP 768:rTkpTd9ICFHvo3lVHhvQ/xthGEUJyGOTAqFX9iUQs/kuT2EDcXnpEgvbBG:EXIgA3lh+/dwJyfZFX9hD/k4upEO
- TLSH T1CB336C2677A1C032E46629745D75C2B25B7F78225678C7873B8807BDAF713C09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH