Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 16:35
General
- Target 2026-09-16_d7304ba7bc89219475be27be681348c8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 295KB
- Sample260916-t3699sdm2t
- SHA256 14dc792a6b34c17026d609fac9a48e150a215b104580ab7930bf2e059600e727
Malware Config
Extracted
-
redline
-
OliverMaxtest100
-
82.115.223.15:15486
-
auth_value
f31d31ed9e644f3f842dc7949595870f
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_d7304ba7bc89219475be27be681348c8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_d7304ba7bc89219475be27be681348c8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/928-0-0x00000000749F2000-0x00000000749F3000-memory.dmp
memory/928-1-0x0000000002660000-0x00000000026A6000-memory.dmp
memory/928-4-0x00000000026E0000-0x0000000002724000-memory.dmp
memory/928-5-0x00000000749E0000-0x000000007519C000-memory.dmp
memory/928-3-0x00000000749E0000-0x000000007519C000-memory.dmp
memory/928-2-0x0000000004D80000-0x000000000533A000-memory.dmp
memory/928-129-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-131-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-247-0x00000000749E0000-0x000000007519C000-memory.dmp
memory/928-127-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-125-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-123-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-121-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-119-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-115-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-113-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-111-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-109-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-108-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-105-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-103-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-97-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-93-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-91-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-89-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-87-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-85-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-83-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-81-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-79-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-77-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-71-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-69-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-67-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-65-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-61-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-59-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-57-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-55-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-53-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-49-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-47-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-45-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-43-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-41-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-39-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-35-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-33-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-31-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-29-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-27-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-25-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-23-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-21-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-19-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-15-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-13-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-11-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-117-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-102-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-99-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-95-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-75-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-73-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-63-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-51-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-37-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-17-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-9-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-7-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-6-0x00000000026E0000-0x000000000271F000-memory.dmp
memory/928-913-0x0000000005340000-0x0000000005958000-memory.dmp
memory/928-914-0x0000000005960000-0x0000000005A6A000-memory.dmp
memory/928-916-0x0000000005A90000-0x0000000005AA2000-memory.dmp
memory/928-915-0x00000000749E0000-0x000000007519C000-memory.dmp
memory/928-917-0x0000000005AB0000-0x0000000005AEC000-memory.dmp
memory/928-918-0x0000000005C00000-0x0000000005C4C000-memory.dmp
memory/928-919-0x00000000749F2000-0x00000000749F3000-memory.dmp
memory/928-920-0x00000000749E0000-0x000000007519C000-memory.dmp