Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 12:34
General
- Target 2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe
- Size 574KB
- Sample260922-pr49baee22
- SHA256 0dbd10082d1de254c296f7ba2fe691e8aca204f02feee5642e757a519ea5a65f
Malware Config
Extracted
-
redline
-
gena
-
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Detects executables packed with ConfuserEx Mod 3 IoCs
- Executes dropped EXE 1 IoCs
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 14042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5640 -ip 56401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.exe
memory/764-2167-0x0000000000B30000-0x0000000000B5E000-memory.dmp
memory/764-2170-0x0000000002E30000-0x0000000002E36000-memory.dmp
memory/764-2169-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/764-2171-0x0000000005C80000-0x0000000006298000-memory.dmp
memory/764-2180-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/764-2176-0x00000000056A0000-0x00000000056EC000-memory.dmp
memory/764-2174-0x0000000005660000-0x000000000569C000-memory.dmp
memory/764-2175-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/764-2173-0x00000000054C0000-0x00000000054D2000-memory.dmp
memory/764-2172-0x0000000005770000-0x000000000587A000-memory.dmp
memory/5640-128-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-108-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-14-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-20-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-36-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-46-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-52-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-56-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-58-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-66-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-72-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-77-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-86-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-92-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-96-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-104-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-112-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-118-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-122-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-124-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-132-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-9-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-12-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-10-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-16-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-18-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-22-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-28-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-54-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-94-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-139-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5640-134-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-130-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-6-0x00000000051A0000-0x000000000575A000-memory.dmp
memory/5640-126-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-120-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-116-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-114-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-110-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-8-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5640-106-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-102-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-100-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-98-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-90-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-88-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-84-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-82-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-80-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-78-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-74-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-70-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-68-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-65-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-62-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-61-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-50-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-48-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-44-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-42-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-40-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-38-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-34-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-33-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-31-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-26-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-24-0x00000000057A0000-0x0000000005800000-memory.dmp
memory/5640-7-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/5640-5-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5640-4-0x0000000002A90000-0x0000000002AF8000-memory.dmp
memory/5640-3-0x0000000074E32000-0x0000000074E33000-memory.dmp
memory/5640-2-0x00000000024A0000-0x00000000024FB000-memory.dmp
memory/5640-2156-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5640-2157-0x00000000059E0000-0x0000000005A12000-memory.dmp
memory/5640-2168-0x0000000000A20000-0x0000000000B20000-memory.dmp
memory/5640-2178-0x00000000024A0000-0x00000000024FB000-memory.dmp
memory/5640-2179-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/5640-1-0x0000000000A20000-0x0000000000B20000-memory.dmp