Overview

overview

7

Static

static

3

2026-09-23...op.exe

windows10-2004-x64

7

2026-09-23...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 10:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  • Size 6.8MB
  • Sample260924-me2xbabc44
  • SHA256 11fbc982247706cc429e6a46b740f81a78d4c35ab97c223b2a6aeefd8df7a895
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 42 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5960
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
        C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2144

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
        • Size 225KB
        • SHA256 1965546a19990b4523a1588eb0d7fdd42bd443e2bcc632dae04343d358394ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CET_Archive.dat
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\CET_Archive.dat
        • Size 6.5MB
        • SHA256 e7746983fa789eb43210da75a092aac6a7458b46b96f29db0b95961043473fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\2026-09-23_3dae9ffa09b4e7dd332e054c7a131fb7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
        • Size 12.5MB
        • SHA256 a3da8849690d5551cbbcfdae6aab05848e1b85e8cd0c06520e7452831e4a378e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CET_TRAINER.CETRAINER
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\CET_TRAINER.CETRAINER
        • Size 9KB
        • SHA256 9cb07d46fa15b389f466e395ebbaab6f92b8f3b1fd06c9f29df9887619689b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        defines.lua
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\defines.lua
        • Size 12KB
        • SHA256 42ddf4de2d9e48adcdc3d0c1fbbf81c748d576a72452c42ced24087062a03a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lua53-32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\lua53-32.dll
        • Size 453KB
        • SHA256 435cb67e970ff69626f4adc7e9e2edad24ce6ef62ad266eb56058f7223a2399d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbghelp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET428D.tmp\extracted\win32\dbghelp.dll
        • Size 1.7MB
        • SHA256 74ccb6f5334248ba7020b9cddc7d581fc6a3ac5a034489324a1fc134cf21de6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download