duptwux | fa28eb60393415b642dc71f33ab7c5fe0a33f24d8003455f23786a1a60cad495

General

Target
2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Size 356KB
Sample260903-vpdapscm91
SHA256 fa28eb60393415b642dc71f33ab7c5fe0a33f24d8003455f23786a1a60cad495
MD5 02cb9cd5e150e88c96a5758e9134d7ff
SHA1 db95e0aed69d455de11cff096a68dbaa62abe48f
SHA512 be0a12949ef92256639f4e715c72908b934cb4db97dc1338196b116737fc82e9e3d5c2306987b92b6d908409ceb9e14f1a9263312692ed96e21418cf4a2ad78f
SSDEEP 3072:dVHgCc4xGvbwcU9KQ2BBAHmaPxuHVo17JECW77G0EvguCEFev5fD4uHDFSTtCc:gCc4xGxWKQ2BonxwE4MgxDITkc
TLSH
T111748D11F380C036E4A141B989B7CB71AA6D7E705B6862CB63D03A9E6F712D1BD3131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery duptwux worm

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.byethost12.com
Port
21
Username
b12_8082975
Password
951753zx

Signatures

Family: Duptwux
Duptwux is a Windows worm written in C++.
worm duptwux

Detects Duptwux 1 IoCs

resource	yara_rule
behavioral2/files/0x0003000000008f19-10.dat	family_duptwux

Modifies firewall policy service 3 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications\list\C:\Windows\system32\inf\svchost.exe = "C:\\Windows\\system32\\inf\\svchost.exe:*:Enabled:@xpsp2res.dll,-22001"	svchost.exe
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\standardprofile	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications\list	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications\list\C:\Windows\system32\inf\svchost.exe = "C:\\Windows\\system32\\inf\\svchost.exe:*:Enabled:@xpsp2res.dll,-22001"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications\list\C:\Program Files (x86)\7a080c03\jusched.exe = "C:\\Program Files (x86)\\7a080c03\\jusched.exe:*:Enabled:JavaUpdate23"	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications\list\C:\Windows\system32\inf\svchost.exe = "C:\\Windows\\system32\\inf\\svchost.exe:*:Enabled:@xpsp2res.dll,-22001"	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	svchost.exe
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	jusched.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\authorizedapplications\list\C:\Windows\system32\inf\svchost.exe = "C:\\Windows\\system32\\inf\\svchost.exe:*:Enabled:@xpsp2res.dll,-22001"	jusched.exe

Executes dropped EXE 3 IoCs

pid	Process
1856	svchost.exe
4916	jusched.exe
3292	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\inf\svchost.exe	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\inf\svchost.exe	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\inf\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\inf\svchost.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\inf\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\inf\svchost.exe	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7a080c03\jusched.exe	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
File created	C:\Program Files (x86)\7a080c03\7a080c03	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INETINFO.exe	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
File created	C:\Windows\INETINFO.exe	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\INETINFO.exe	svchost.exe
File created	C:\Windows\Tasks\Update23.job	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\INETINFO.exe	jusched.exe
File opened for modification	C:\Windows\INETINFO.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 120 wrote to memory of 4916	120	2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120
- C:\Program Files (x86)\7a080c03\jusched.exe
  "C:\Program Files (x86)\7a080c03\jusched.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4916

C:\Windows\SysWOW64\inf\svchost.exe
C:\Windows\SysWOW64\inf\svchost.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1856

C:\Windows\SysWOW64\inf\svchost.exe
C:\Windows\SysWOW64\inf\svchost.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7a080c03

Path C:\Program Files (x86)\7a080c03\7a080c03
Size 17B
SHA256 54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781
MD5 134c1d489094d6d3399f65b0e9aebc1f
SHA1 612a57fbe6ed3ab9c15b39451171d813314a28d5
SHA512 b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed
MD5 SHA1 SHA512

Submit Download

jusched.exe

Path C:\Program Files (x86)\7a080c03\jusched.exe
Size 356KB
SHA256 0b000c139858582bb3b59a95af5b3bb24d676c6649080f28a25669cfb11c447f
MD5 e34e83a55660c32623f55c0148ad2d32
SHA1 b71becaf04be23ae1eb600c848b6a171891b88e8
SHA512 c75f6f74f81026aa463576fb8e07125fade709cdbc47add06b08cb76867862a2579a5e391170aee62849a912b6d007d2ab565f7f2d6a5be3a81c2449a43de041
SSDEEP 3072:3VHgCc4xGvbwcU9KQ2BBAHmaPxuHVo37JEDW77G0EvguCEFev5fD4uHDFSTtC4:+Cc4xGxWKQ2Bonx7E4MgxDITk4
TLSH
T10A748D11F380C036E4A141B989B7CB71AA6D7E705B6862CB63D03A9E6F712D1BD3135B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\SysWOW64\inf\svchost.exe
Size 85KB
SHA256 118d96e63af49c88b917bd8a66293259c5b0b77eae88b2ea919dfbe9246e9c80
MD5 9806059a28fda671bad004b7a107e537
SHA1 822cf6de7ae3ea2d157ca08b08a70685c8e69776
SHA512 34d2a3788e4e210d013dbc32d08a478143e9620b1f2adf6a71edb679046e2512cefdb0f5623d8e47f4476b5ed7c001b22ff0c38d503ac43edcd2efeb827a6ba7
SSDEEP 1536:DxDAYXiGIE4/5oYOq6wPUv5OU334uH6ioe:DxMYXvIMkPUv5Og4uHDN
TLSH
T1A9833A12F6D0C472E16616340872C7A01B7FBC22A775878F6B543BAEAE316D09E35367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/120-19-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4916-15-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4916-23-0x0000000000400000-0x0000000000466000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads