Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 16:35
General
- Target 2026-09-16_d7304ba7bc89219475be27be681348c8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 295KB
- Sample260916-t3699sdm2t
- SHA256 14dc792a6b34c17026d609fac9a48e150a215b104580ab7930bf2e059600e727
Malware Config
Extracted
-
redline
-
OliverMaxtest100
-
82.115.223.15:15486
-
auth_value
f31d31ed9e644f3f842dc7949595870f
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_d7304ba7bc89219475be27be681348c8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_d7304ba7bc89219475be27be681348c8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4584-0-0x0000000004B90000-0x0000000004BA0000-memory.dmp
memory/4584-1-0x0000000002190000-0x00000000021D6000-memory.dmp
memory/4584-2-0x0000000004B90000-0x0000000004BA0000-memory.dmp
memory/4584-3-0x0000000004BA0000-0x0000000005144000-memory.dmp
memory/4584-4-0x0000000002670000-0x00000000026B4000-memory.dmp
memory/4584-14-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-114-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-130-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-128-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-126-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-124-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-916-0x0000000005980000-0x00000000059CC000-memory.dmp
memory/4584-915-0x0000000004B20000-0x0000000004B5C000-memory.dmp
memory/4584-914-0x0000000004B00000-0x0000000004B12000-memory.dmp
memory/4584-913-0x0000000004B90000-0x0000000004BA0000-memory.dmp
memory/4584-912-0x0000000005770000-0x000000000587A000-memory.dmp
memory/4584-911-0x0000000005150000-0x0000000005768000-memory.dmp
memory/4584-122-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-120-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-118-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-112-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-110-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-108-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-106-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-104-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-102-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-100-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-98-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-96-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-94-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-92-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-90-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-88-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-86-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-84-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-80-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-79-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-76-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-74-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-72-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-71-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-68-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-66-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-64-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-62-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-60-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-58-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-56-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-52-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-50-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-48-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-46-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-44-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-40-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-38-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-36-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-34-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-32-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-30-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-28-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-26-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-24-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-22-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-20-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-18-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-16-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-12-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-10-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-8-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-6-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-5-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-116-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-82-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-54-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-42-0x0000000002670000-0x00000000026AF000-memory.dmp
memory/4584-917-0x0000000004B90000-0x0000000004BA0000-memory.dmp
memory/4584-918-0x0000000004B90000-0x0000000004BA0000-memory.dmp