34818ed8a7cff57f95567883ab78363148e2c5fd13212a525b991583517b4c4d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Size 123KB
Sample260912-wgpt7styex
SHA256 34818ed8a7cff57f95567883ab78363148e2c5fd13212a525b991583517b4c4d
MD5 c709a4951ed6ff5e5a12d15e9a4f2d46
SHA1 09a8fb22d24709c503af1213e4af0c0630f8201c
SHA512 0263e2e22cf591fd7af5c8fba551bd591a1533ff32193021ff1fc2893938bc80a3da56386c05f55ba1d006626a1bb5be13cdaf996b39acbb1f22fb48833dc126
SSDEEP 1536:iqGFRfepwMDhyilGlvO7D98ajx9vk3V1Ft9r9oL7Fk5qSYwtsd:KDlqDRsPt9r94Fk5qSCd
TLSH
T16AC38C117D62E177C04AC6F00929D361EEBE6931667855C3F3890FB99EB12D06A3E34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe

Executes dropped EXE 1 IoCs

pid	Process
4264	AhnSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run"	2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AhnSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	4264	AhnSvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 4264	2356	2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe	82
PID 2356 wrote to memory of 3480	2356	2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\ProgramData\AhnLab\AhnSvc.exe
  "C:\ProgramData\AhnLab\AhnSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\2026-09-12_c709a4951ed6ff5e5a12d15e9a4f2d46_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AhnSvc.exe

Path C:\ProgramData\AhnLab\AhnSvc.exe
Size 123KB
SHA256 543ffe4fecb839a1116541f9805ad6b8f445a06be72049a6dee0e93edc2f4d01
MD5 c920e3734d421d570eab7b50c78b6a29
SHA1 800957756e12bd2f2b994486f61e0abbfe0ab737
SHA512 42ba246d41a005d8ff6b4c503cfec23ea1844a1621b3083e2c37855d6fb20d093e11414fcbe5731f6bb12f42ecb3639530b5ebae3b13ca47e2f3598f7a75e932
SSDEEP 1536:iqGFRfepwMDhyilGlvO7D98ajx9vk3V1Ft9r9oL7Fk5qSYwts9:KDlqDRsPt9r94Fk5qSC9
TLSH
T1BEC38C117D62E177C04AC6F00929D361EEBE6931667855C3F3890FB99EB12D06A3E34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-6-0x00000000000A0000-0x00000000000BF000-memory.dmp

Download

memory/4264-8-0x00000000000A0000-0x00000000000BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads