Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/09/2026, 12:34
General
- Target 2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe
- Size 574KB
- Sample260922-pr49baee22
- SHA256 0dbd10082d1de254c296f7ba2fe691e8aca204f02feee5642e757a519ea5a65f
Malware Config
Extracted
-
redline
-
gena
-
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Detects executables packed with ConfuserEx Mod 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 14362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3124 -ip 31241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.exe
memory/2316-2168-0x0000000000470000-0x000000000049E000-memory.dmp
memory/2316-2169-0x0000000000D50000-0x0000000000D56000-memory.dmp
memory/2316-2170-0x00000000053B0000-0x00000000059C8000-memory.dmp
memory/2316-2171-0x0000000004EA0000-0x0000000004FAA000-memory.dmp
memory/2316-2178-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/2316-2175-0x0000000004E40000-0x0000000004E8C000-memory.dmp
memory/2316-2174-0x0000000004DF0000-0x0000000004E2C000-memory.dmp
memory/2316-2173-0x0000000004D90000-0x0000000004DA2000-memory.dmp
memory/2316-2172-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/3124-75-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-63-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-17-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-39-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-107-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-133-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-131-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-129-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-127-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-125-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-123-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-121-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-119-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-117-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-115-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-113-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-111-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-109-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-105-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-104-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-101-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-99-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-97-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-95-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-93-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-91-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-89-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-87-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-85-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-83-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-81-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-77-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-6-0x00000000050C0000-0x0000000005664000-memory.dmp
memory/3124-73-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-71-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-69-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-67-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-7-0x0000000005670000-0x00000000056D6000-memory.dmp
memory/3124-61-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-60-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-55-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-53-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-52-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-49-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-47-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-45-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-43-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-41-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-37-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-35-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-33-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-31-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-29-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-27-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-25-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-23-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-21-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-19-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-15-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-13-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-11-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-79-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-65-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-5-0x00000000050B0000-0x00000000050C0000-memory.dmp
memory/3124-4-0x0000000002B40000-0x0000000002BA8000-memory.dmp
memory/3124-3-0x00000000050B0000-0x00000000050C0000-memory.dmp
memory/3124-2-0x0000000002350000-0x00000000023AB000-memory.dmp
memory/3124-57-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-9-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-8-0x0000000005670000-0x00000000056D0000-memory.dmp
memory/3124-2154-0x00000000050B0000-0x00000000050C0000-memory.dmp
memory/3124-2155-0x0000000005890000-0x00000000058C2000-memory.dmp
memory/3124-2177-0x0000000002350000-0x00000000023AB000-memory.dmp
memory/3124-1-0x0000000000970000-0x0000000000A70000-memory.dmp