Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 4.1MB
- Sample260910-2jrdpsyzbt
- SHA256 142dfe69b9bcbe073103c5c6c3abf499d3fee59c5764612c02c0674e15cf757c
- MD5 df0c003b22cd9c80259b6811121404d5
- SHA1 9db1b5eb7b57ea89fae6889c3c321a19ab6a3fe6
- SHA512 8c37177dcf97a3a1f8abdfad721bb11a0e1e86d3a642fba42e5a96ef5aa89c1d234940d0822d916f56a6d893ea9398e3cf87da43888ba3d2908c4282cf5a0b43
- SSDEEP 98304:1cNotT0PWd/0taw7uon9Q0QdfaVnpo3elKJJMQaftPT87+sQ:CotTR/guG92EnpoulKQQCII
- TLSH T1AD1633616003E071E43F503D5D0196B4E17BE5B1906986F37B4C2EFAAE71BC1F78A29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Glupteba payload 22 IoCs
resource yara_rule behavioral2/memory/5052-2-0x0000000005370000-0x0000000005C5B000-memory.dmp family_glupteba behavioral2/memory/5052-34-0x0000000005370000-0x0000000005C5B000-memory.dmp family_glupteba behavioral2/memory/5052-35-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/1992-70-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/5848-102-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-113-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/5316-122-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/5276-129-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-134-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4564-139-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4564-151-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-152-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-153-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-154-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-155-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-156-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-157-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-158-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-159-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-160-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-161-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/6100-162-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba - Windows security bypass 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Detects Windows executables referencing non-Windows User-Agents 20 IoCs
resource yara_rule behavioral2/memory/5052-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1992-70-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/5848-102-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-113-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/5316-122-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/5276-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-134-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4564-139-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4564-151-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-152-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-153-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-155-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/6100-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Detects executables Discord URL observed in first stage droppers 20 IoCs
resource yara_rule behavioral2/memory/5052-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/1992-70-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/5848-102-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-113-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/5316-122-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/5276-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-134-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4564-139-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4564-151-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-152-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-153-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-155-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/6100-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL - Detects executables containing URLs to raw contents of a Github gist 20 IoCs
resource yara_rule behavioral2/memory/5052-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/1992-70-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/5848-102-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-113-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/5316-122-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/5276-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-134-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4564-139-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4564-151-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-152-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-153-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-155-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/6100-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables containing artifacts associated with disabling Widnows Defender 20 IoCs
resource yara_rule behavioral2/memory/5052-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/1992-70-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/5848-102-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-113-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/5316-122-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/5276-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-134-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4564-139-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4564-151-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-152-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-153-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-155-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/6100-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender - Detects executables referencing many varying, potentially fake Windows User-Agents 20 IoCs
resource yara_rule behavioral2/memory/5052-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/1992-70-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/5848-102-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-113-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/5316-122-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/5276-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-134-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4564-139-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4564-151-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-152-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-153-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-155-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/6100-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5276 netsh.exe - Executes dropped EXE 6 IoCs
pid Process 6100 csrss.exe 5848 csrss.exe 5316 csrss.exe 5276 csrss.exe 4564 csrss.exe 1188 injector.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 34 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_axfywwnj.05b.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_e1crdduw.afy.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_on2lcnsw.iza.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wpk0vpcc.opp.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vde0lvx0.uqt.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ikdeswya.tgi.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_qo0m5ufz.ntv.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_pntywoi1.2mr.psm1 powershell.exe File created C:\Windows\rss\csrss.exe 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_3egjb5zx.ibs.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_eppbgu2u.dby.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_hmyg2vaw.bns.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2rgwysgc.yki.psm1 powershell.exe File opened for modification C:\Windows\rss 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_erp5dc4e.4ko.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_b21t4hav.q3k.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wptzynfn.roz.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_fxpzaxqd.30s.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_u4ofjnye.23e.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_gnz1xvju.ptz.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_tlkrph5y.2sf.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_dabydo00.gah.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_kdlbs1jc.odt.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_nxc3m00j.rjr.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wzwswdoa.ekt.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ehr2543k.zz5.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_adgfekhu.pqv.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5ufplwpm.qwe.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_sjgd1mjs.bdx.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_inu24ogf.rma.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_pumjr4j0.nf4.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_aer1ziki.ygt.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_251o3jbw.o3i.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_p4dxlypv.rwy.psm1 powershell.exe -
pid Process 4892 powershell.exe 4644 powershell.exe 3984 powershell.exe 3388 powershell.exe 4596 powershell.exe 4560 powershell.exe 484 powershell.exe 1676 powershell.exe 6096 powershell.exe 1300 powershell.exe 4916 powershell.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2404 cmd.exe - Program crash 3 IoCs
pid pid_target Process procid_target 3948 1992 WerFault.exe 95 4904 5316 WerFault.exe 129 5492 4564 WerFault.exe 136 - System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4744 schtasks.exe 5460 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4916 powershell.exe 4916 powershell.exe 4916 powershell.exe 5052 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 5052 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 4560 powershell.exe 4560 powershell.exe 4560 powershell.exe 484 powershell.exe 484 powershell.exe 484 powershell.exe 4644 powershell.exe 4644 powershell.exe 4644 powershell.exe 3984 powershell.exe 3984 powershell.exe 3984 powershell.exe 1676 powershell.exe 1676 powershell.exe 1676 powershell.exe 5848 csrss.exe 5848 csrss.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 6096 powershell.exe 6096 powershell.exe 6096 powershell.exe 5316 csrss.exe 5316 csrss.exe 1300 powershell.exe 1300 powershell.exe 1300 powershell.exe 4596 powershell.exe 4596 powershell.exe 4596 powershell.exe 1188 injector.exe 1188 injector.exe 1188 injector.exe 1188 injector.exe 6100 csrss.exe 6100 csrss.exe 1188 injector.exe 1188 injector.exe 1188 injector.exe 1188 injector.exe 1188 injector.exe 1188 injector.exe 6100 csrss.exe 6100 csrss.exe 1188 injector.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4916 powershell.exe Token: SeIncreaseQuotaPrivilege 4916 powershell.exe Token: SeSecurityPrivilege 4916 powershell.exe Token: SeTakeOwnershipPrivilege 4916 powershell.exe Token: SeLoadDriverPrivilege 4916 powershell.exe Token: SeSystemProfilePrivilege 4916 powershell.exe Token: SeSystemtimePrivilege 4916 powershell.exe Token: SeProfSingleProcessPrivilege 4916 powershell.exe Token: SeIncBasePriorityPrivilege 4916 powershell.exe Token: SeCreatePagefilePrivilege 4916 powershell.exe Token: SeBackupPrivilege 4916 powershell.exe Token: SeRestorePrivilege 4916 powershell.exe Token: SeShutdownPrivilege 4916 powershell.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeSystemEnvironmentPrivilege 4916 powershell.exe Token: SeRemoteShutdownPrivilege 4916 powershell.exe Token: SeUndockPrivilege 4916 powershell.exe Token: SeManageVolumePrivilege 4916 powershell.exe Token: 33 4916 powershell.exe Token: 34 4916 powershell.exe Token: 35 4916 powershell.exe Token: 36 4916 powershell.exe Token: SeDebugPrivilege 5052 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeImpersonatePrivilege 5052 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 4892 powershell.exe Token: SeAssignPrimaryTokenPrivilege 4892 powershell.exe Token: SeIncreaseQuotaPrivilege 4892 powershell.exe Token: SeSecurityPrivilege 4892 powershell.exe Token: SeTakeOwnershipPrivilege 4892 powershell.exe Token: SeLoadDriverPrivilege 4892 powershell.exe Token: SeSystemtimePrivilege 4892 powershell.exe Token: SeBackupPrivilege 4892 powershell.exe Token: SeRestorePrivilege 4892 powershell.exe Token: SeShutdownPrivilege 4892 powershell.exe Token: SeSystemEnvironmentPrivilege 4892 powershell.exe Token: SeUndockPrivilege 4892 powershell.exe Token: SeManageVolumePrivilege 4892 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeAssignPrimaryTokenPrivilege 4560 powershell.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe Token: SeRestorePrivilege 4560 powershell.exe Token: SeShutdownPrivilege 4560 powershell.exe Token: SeSystemEnvironmentPrivilege 4560 powershell.exe Token: SeUndockPrivilege 4560 powershell.exe Token: SeManageVolumePrivilege 4560 powershell.exe Token: SeDebugPrivilege 484 powershell.exe Token: SeAssignPrimaryTokenPrivilege 484 powershell.exe Token: SeIncreaseQuotaPrivilege 484 powershell.exe Token: SeSecurityPrivilege 484 powershell.exe Token: SeTakeOwnershipPrivilege 484 powershell.exe Token: SeLoadDriverPrivilege 484 powershell.exe Token: SeSystemtimePrivilege 484 powershell.exe Token: SeBackupPrivilege 484 powershell.exe Token: SeRestorePrivilege 484 powershell.exe Token: SeShutdownPrivilege 484 powershell.exe Token: SeSystemEnvironmentPrivilege 484 powershell.exe Token: SeUndockPrivilege 484 powershell.exe Token: SeManageVolumePrivilege 484 powershell.exe Token: SeDebugPrivilege 4644 powershell.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4916 5052 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 90 PID 1992 wrote to memory of 4892 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 96 PID 1992 wrote to memory of 2404 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 98 PID 2404 wrote to memory of 5276 2404 cmd.exe 130 PID 1992 wrote to memory of 4560 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 134 PID 1992 wrote to memory of 484 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 104 PID 1992 wrote to memory of 6100 1992 2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 106 PID 6100 wrote to memory of 4644 6100 csrss.exe 112 PID 5848 wrote to memory of 3984 5848 csrss.exe 114 PID 6100 wrote to memory of 1676 6100 csrss.exe 120 PID 5316 wrote to memory of 3388 5316 csrss.exe 131 PID 5276 wrote to memory of 6096 5276 csrss.exe 133 PID 6100 wrote to memory of 1300 6100 csrss.exe 139 PID 4564 wrote to memory of 4596 4564 csrss.exe 141 PID 6100 wrote to memory of 1188 6100 csrss.exe 143 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_df0c003b22cd9c80259b6811121404d5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5276
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:4744
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4432
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1676
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1188
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:5460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 7203⤵
- Program crash
PID:3948
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1992 -ip 19921⤵PID:4588
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6096 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4560
-
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 8083⤵
- Program crash
PID:5492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 8962⤵
- Program crash
PID:4904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5316 -ip 53161⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4564 -ip 45641⤵PID:5036
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 fc2a149dd941baefc81291d1a06f10a63a205b2d920ebdff3fd723925fc13cdf
- MD5 76295f3fcdabd042ffa57daaa69bf5ed
- SHA1 4d4a756f9cc19bfaab47658a418ef371c9b52188
- SHA512 1e60950d855d166787b7dbfb916c73b9fd5a78a82e063bb524288a2fbc100b37209973cb9ccf71ca8f76d161734ccd56138148ec791d62ad33c65119102c3858
- SSDEEP 384:K1eBaoT1iBVslso0w2Fz6gIR2PtWOEPiUDzdC0BWIAgl3M6h5O435S3lSbhN25R+:aexZ6VslsoTMz6gxUN6UFC0BWIAgl3M4
- TLSH T13DA2D73C217B8C87EE9221F441D00BA9FBE4D003D5E150D9BB9EDE1E5C45E764AA12F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 22KB
- SHA256 2b7f1cf74eed37b006e63b09ef7f120634af9fe7bc347cdf42e708846f434888
- MD5 8c0499a799232d6c4cae877b0ae54dcd
- SHA1 8d5b89ad0b126af2658b04471a224512e44314a1
- SHA512 12e72865361c1d5542f42ea158f6f8f5ac4cd8ef16663f03ac691cc5f5a63c2259597cf1f884ac764249936eff312e8221eefc7606070afa6697f2dc93522e87
- SSDEEP 384:a1eBaoaI1iBVbGW14b0ddNiS+geKEp2p2P4NIArlZJ4R9LXeqWfcRRx1ocMQ6rav:KexaY6VyWiwdd1+gbkuIArTJQbeBcrxF
- TLSH T10BA2B678213F6DC7D8D212B011D202E7FBE4D449DAB555D8FF2FDA2F0CA0AB64AA0524
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
- Size 281KB
- SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
- MD5 d98e33b66343e7c96158444127a117f6
- SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
- SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
- SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
- TLSH T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 80cbce86a37f77727277902c663204b169dbb75b82487f271f8cc621f33844b1
- MD5 c0587d354efc59e9d4ccd13ee96bb022
- SHA1 69bd7066b043e9fcc1cf9c5501742770a5845bc8
- SHA512 b3699db7a4d821578b8f6be20f445414d9115aac90d0e896fa61bfe8bcacdb08dda2067358d5f5190cdd36109f3b1f8c5b060b8b8dd4d1dee6911f38f64ee63b
- SSDEEP 384:/SEboT1iBGKlUrl0/+qeC2W2fWOEkNIAq3Mi5y4fuAsr3kd6SRX4jABa6fsjLz8i:t0Z6GKlYe/+33uNqIAq3Mih3srU6yXtE
- TLSH T1FBA2E82C26AF9DCBD49061A510814383E7E8E158A3E611EFFF1FC92F2C45A7E5B501E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 74cd32b84114eb4a016f8d93ca60dd18b58864408f364e809c769fd154f36bd6
- MD5 40c9b156a31f594e6be62c80a3dca0c7
- SHA1 f382352b3e2d4121a3eda25f4bf588d38cf0b49b
- SHA512 5e02bb367bad87531920b313a3bdeeace4e9ba2ce67f3b0f3f4cbd8f3640cd955ac8f4f9985b06e0c45cd3485d543941870f3323c95982b01915c88d9b8411b5
- SSDEEP 384:r1eBaoT1iBGkEbTyQj2c/+zeqwNhR2VWOEkMzdCRIl3M6WwIlov35SJr3k96dRX6:JexZ6GfP5B/+zUSUNZCul3M6tdv0rk62
- TLSH T186A2F72D26BF59CBC45160B91491474BEBE8D199A3E212EBEF0BC91F384167D9E500FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 d0856d6a72affcbf14225c810225f55ee7ccaaf2e96570094c79566e43c54294
- MD5 5900b7714e2e8a5cda434cfb5c7affe8
- SHA1 45e52dd47384e2376846aba5220c076a44afdd4f
- SHA512 d7200df36e0df4bbfe187e45b09003c82ab095393e3a143861030c0d2c5f96d016795841a463730e75a40b91dfe775a762f5e9f72a14d060e019663d3aaf1193
- SSDEEP 384:t1eBaoT1iBV4gm70mfX+geCZQCVziUDzdCS8Il3M6X5Kd4t1GAzVtPi6BbRYEB29:nexZ6V4gm7PX+6QbUFCStl3M6pKafzV4
- TLSH T1F4A2F92C26AF5DCBC491217425804397EBE8D058A3F542AFBB5FD91F2C45ABE4E901EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 5ee3bc3d3ff846478f60391d73feacb4e4aa0bfb3a3c45cf1abb4235f65f095a
- MD5 70c29b5375e250e8e58a804fc2c5237f
- SHA1 c7c651fea027a556ac9dea78868e3d357d924b5a
- SHA512 8d5617a5a8761cf8bcc62edd935be8fe2c60158e98e9e79034d72627e9e2e99ef2268f16d0e81d25d33056268174fece6099f26d52288a1cd3df52bedc23ab6e
- SSDEEP 384:ySEboT1iBVaGW14blLM6yta/0f+gejrr2PnZIArlZO5t4PstdP5S1mJJ6bhNBUpF:m0Z6VBWiB46Z/2+B6RIArTK8sfXobhNk
- TLSH T14AA2C578213F6DC7D8D212B051D10AE7FBE4E4499AB65098BF2FDE2F4C90AB74E60524
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 7a3a12d8f74a5334a339828d6b88a6bb0d911a4abd9b35063a06f8bf169a5db1
- MD5 22087739a6d06b9f02d6936268a2e992
- SHA1 191cec4e3f5c5a056b45562905ca1fa74d7ef17e
- SHA512 2e9f5981c1d893cf357d79c0892c4f9e123f2025ca9145d1baf1f73e16e3f82a18e19e34f3568723c4da9a9bb9324e15c77565241c6a15df9e244fdbaec5e049
- SSDEEP 384:GSEboT1iBGTibOkxbz+gTqOraOshnMkIAr23M6X5YloaJAsrXG/6BcRX4jABrf9S:a0Z6GWfxP+Qj7sKkIAr23M6ptPsro6Br
- TLSH T16EA2D72D26AF9DCBC490627900814343E7E8D168A3E656DFEF4FC92F2845A7D5E501E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 fe3e7fdba3d47f828e74759bf06cf6bb58e611e484edf46f491243aa03e910a1
- MD5 ff62bf528d0296ab309a2011cc99ed04
- SHA1 132209109b3e4d42d73c04f0893cc3e51a5b0d8c
- SHA512 3166e4134ada8761c06a73489e39e0cbb15d082ea843ef9c9e8a9563c75f1b5006577e930a5950475c741e1409927cfa02aa7beb094dc5ab90f48b75823f7b47
- SSDEEP 384:81eBaoT1iBGmibJyGVpHYQ16g/gh3WOEfzdC0AIAq3M6J6doi42b3kx6B/RX4jAO:4exZ6GDlPVp4o6gYQNZC0AIAq3M6J6S3
- TLSH T13DA2E62D26AF8D8BDA5160F400910B86FBE8D152E3D242DBEB5BCD1F2845A7D5E901FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 41886bda9bbf7900bac9c331aa4ab305a6f437b46955bbf57284b5a4e107aede
- MD5 e52f1bc662c1a7d548953dd4f85c14ff
- SHA1 46a45511714351798d3ed0b5a7ed6bd965f8f55b
- SHA512 b15911420ce7c0f05972eda2083cdee0907185e4e6f2f1bd210c43b1bae62492d27b2c8632a225426cc5d2df4579758c5721b9e8f8236e3e5b4124fb56428f96
- SSDEEP 384:/Q1eBaoT1iBVJRGlg2DVJejs7+1dzidr2PiOE6UDzdC0wIAr23MW58loy45SiV30:/cexZ6VJElgoVJejs7+g6aN6UFC0wIAx
- TLSH T181A2E72C26BF99CBC49162B410814383EBE8D159A3F151DBFB5BC92F2C45A7D4E901F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_kdlbs1jc.odt.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\rss\csrss.exe
- Size 4.1MB
- SHA256 142dfe69b9bcbe073103c5c6c3abf499d3fee59c5764612c02c0674e15cf757c
- MD5 df0c003b22cd9c80259b6811121404d5
- SHA1 9db1b5eb7b57ea89fae6889c3c321a19ab6a3fe6
- SHA512 8c37177dcf97a3a1f8abdfad721bb11a0e1e86d3a642fba42e5a96ef5aa89c1d234940d0822d916f56a6d893ea9398e3cf87da43888ba3d2908c4282cf5a0b43
- SSDEEP 98304:1cNotT0PWd/0taw7uon9Q0QdfaVnpo3elKJJMQaftPT87+sQ:CotTR/guG92EnpoulKQQCII
- TLSH T1AD1633616003E071E43F503D5D0196B4E17BE5B1906986F37B4C2EFAAE71BC1F78A29A
- MD5 SHA1 SHA512 SSDEEP TLSH