257cc2c583ff68902776e826b9c23f69108a680f8ca271f41bd912105da1163e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 408KB
Sample260827-cqa8mayfkc
SHA256 257cc2c583ff68902776e826b9c23f69108a680f8ca271f41bd912105da1163e
MD5 f5070035c1cb82dd17a812782d205fe1
SHA1 89350eb100f798e4093e34766d46bcccf3c1f953
SHA512 2663815cd5dafa0a179f40c96a7d677378f51f06e940b16fec7148ac28eb5478ad5eac3b901e565b4fc6d924b375c47a643863d4b7e5f3fa0a1b81b4d455fcad
SSDEEP 3072:zL7q8fUjVkmmdzgwLmLGPs9v3Wv7FPdvJVyl3lJ:/fURkm7vkdvJV0
TLSH
T17A94F802B216E9F0D868847A1517A5F627CA2D311F0FAD33B359BF3739721E06A2571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4904	system.exe
2604	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Loads dropped DLL 3 IoCs

pid	Process
3584	Rundll32.exe
924	Rundll32.exe
924	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\fkfhahaa.dll	system.exe
File created	C:\Windows\SysWOW64\qiriahaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\windows.exe	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4756	sc.exe
4560	sc.exe
3004	sc.exe
2788	sc.exe
2416	sc.exe
1684	sc.exe
5000	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
3584	Rundll32.exe
924	Rundll32.exe
924	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3036	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4904	3036	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89
PID 4904 wrote to memory of 3584	4904	system.exe	90
PID 3584 wrote to memory of 4784	3584	Rundll32.exe	91
PID 3584 wrote to memory of 3040	3584	Rundll32.exe	92
PID 3584 wrote to memory of 2788	3584	Rundll32.exe	93
PID 3584 wrote to memory of 3004	3584	Rundll32.exe	94
PID 3584 wrote to memory of 2416	3584	Rundll32.exe	99
PID 3584 wrote to memory of 4756	3584	Rundll32.exe	100
PID 3584 wrote to memory of 5000	3584	Rundll32.exe	101
PID 3584 wrote to memory of 1684	3584	Rundll32.exe	102
PID 3584 wrote to memory of 3036	3584	Rundll32.exe	87
PID 3584 wrote to memory of 4904	3584	Rundll32.exe	89
PID 3584 wrote to memory of 4784	3584	Rundll32.exe	91
PID 3584 wrote to memory of 3040	3584	Rundll32.exe	92
PID 3584 wrote to memory of 2788	3584	Rundll32.exe	93
PID 3584 wrote to memory of 3004	3584	Rundll32.exe	94
PID 3040 wrote to memory of 3312	3040	net.exe	107
PID 4784 wrote to memory of 3740	4784	net.exe	108
PID 3584 wrote to memory of 4560	3584	Rundll32.exe	110
PID 4904 wrote to memory of 924	4904	system.exe	112
PID 3036 wrote to memory of 2604	3036	2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\fkfhahaa.dll Exxcute
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2788
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3004
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2416
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4756
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5000
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1684
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4560
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\qiriahaa.dll Exucute
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:924
- C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5070035c1cb82dd17a812782d205fe1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 260KB
SHA256 5b4b7abb697cef2800d7c05ba502cd02b48d8b6f8d9e2d59e21d39a764445b4f
MD5 0cd6fd501889eaed6c1884e8591e8087
SHA1 a69502bd18b35126668c4e0fb8eba6e26c3308a9
SHA512 2a29ef8b2814aefac892469f9a04bab397cecb36d75b7ad066877e45b84f0cca15eb5a8c46412357c77dd4bdcc94d66afe97e86a86cc07730c78d897296eb1e0
SSDEEP 1536:zTQVgd54vlVr43oQOdjceIBkPQ54vTgzQ:fL7q8fUjVkmmdz
TLSH
T192449603A216B1E4E82CC87B151771F62BCA2C715E0AAD177159BF3738721E47E16B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3BC7.tmp

Path C:\Users\Admin\AppData\Local\Temp\3BC7.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fkfhahaa.dll

Path C:\Windows\SysWOW64\fkfhahaa.dll
Size 75KB
SHA256 fe79071c980d755d6fb1d920cb6502285b452fecedafddded7fba078fd849d0f
MD5 d15bce781b57100f494bde31dd457b0d
SHA1 74cbb52c3a6158c1212fa768a976c4e37d8027c8
SHA512 84d98b3b74de99bf2e169dd8d117427cb4fc783b509f3ec53e68b01cea7d98029359243a8b31947a0676af480aba3169a1ff1e25ff031815b710579b7411229a
SSDEEP 1536:dhO16RCpc8MiWVWv7tEOPd5/Frd9cqCmh6DY5atOXPQu:dv3Wv7FPdvJV
TLSH
T126735B5C6702CF72C8E109347166C2B1892D12393B9F56B37F9F176AB7A22D1A2387C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qiriahaa.dll

Path C:\Windows\SysWOW64\qiriahaa.dll
Size 22KB
SHA256 37ce328a0c04a5de1606a55088abf71abc0c86fcd113bdc3f1956b3d1882130b
MD5 f12c28f2a2114ec3de5f8f8f3016d0e7
SHA1 222cf179a1c166b9ac7edd1764cbf13ad2bbcff3
SHA512 975c5eeb1ceca48cac01d05649991c5b4160c6970a93f1c8c3a38c3f29345023ffa5b95c4f0f86be6fa431ab98ce25116234dd7eeda5f80bd7e035317eba32cf
SSDEEP 384:tTiEA4bWGRfOr4h0aBOW0RRReNVxQkDMR9CHomdjU:tS4v9hkRKvxyCH9jU
TLSH
T1D3A2B469A758DE71F09240B531B9AE3A245C2831178FA0D7F7C35F5266382F1A636F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 140KB
SHA256 d2af0696b318e78b7cb7560ecfe99fce7efd7bd0e2568f439074431c34bb3ecf
MD5 573f07e84c503c1139a346d99d7ab876
SHA1 a81a5477710cf93e67fc6cd46a2846f7c7290a0d
SHA512 62b9257693ea2d937c1d1bc6aeb8886e8471cdadbb2afd14118de248e39bef3f8315c3196178ea2a60b386bf0ff78f9bc971f54f3984938aca660eaa78797249
SSDEEP 1536:AXL0LzyFf4kbal/PnVPs9hO16RCpc8MiWVWv7tEOPd5/Frd9cqCmh6DY5atOXPQ9:mwLmLGPs9v3Wv7FPdvJVyl3lJ
TLSH
T1E6E37C187701CE32C4E100753066DBB2992D2635279F51B3FBDB0B6ABB612E1A6397C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2604-32-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2604-38-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3036-0-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/3036-10-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/3036-37-0x0000000000400000-0x0000000000468000-memory.dmp

Download