Analysis
- max time kernel
2s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 15:23
General
- Target 2026-09-29_ec956aa840416d31574323af17396796_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 772KB
- Sample260930-ssvytabd87
- SHA256 31d82c73a45613a9389a3a66fc7eaa658f9669d2a40ec2cfdc8b3c4327164cbd
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Program Files directory 56 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ec956aa840416d31574323af17396796_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ec956aa840416d31574323af17396796_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Temp\GUM2188.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM2188.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055N0VLd2pBUUFOQmZLVGRMeVYzdUVzX1JUVmVoNEZRS1JxMmw2WkFtcElqX2J0Xy12akRrOWQydnl4UWluQnFJUmZQNU01VDg3R2liTG5PVlVyZjdyYjRDc1Y1emF0RWplMllVQzRjR1VraHBYR0lfUHZaTWp2eVIxUk95R0dGUnE5WTV0WWpvY0g4cVpMdzF2ejkybmlFMUBNRVRBIn0"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc3⤵
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver3⤵
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1TjBWTGQycEJVVUZPUW1aTFZHUk1lVll6ZFVWelgxSlVWbVZvTkVaUlMxSnhNbXcyV2tGdGNFbHFYMkowWHkxMmFrUnJPV1F5ZG5sNFVXbHVRbkZKVW1aUU5VMDFWRGczUjJsaVRHNVBWbFZ5WmpkeVlqUkRjMVkxZW1GMFJXcGxNbGxWUXpSalIxVnJhSEJZUjBsZlVIWmFUV3AyZVZJeFVrOTVSMGRHVW5FNVdUVjBXV3B2WTBnNGNWcE1kekYyZWpreWJtbEZNVUJOUlZSQkluMCIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjg2My4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0M5RENBRTExLTgzMDktNDZCOS1CQUQzLUVERkJDRkM5OEEyNH0iIHVzZXJpZD0ie0ZERjU2NTgwLUU1RTgtNEIyRi04M0U5LURGRjgxRjAyQjYwMX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins0NDc1NUU3Ri01NTc3LTRDMTYtOTdCQy03MDY3NDFBRUZDODB9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjg2My4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055N0VLd2pBUUFOQmZLVGRMeVYzdUVzX1JUVmVoNEZRS1JxMmw2WkFtcElqX2J0Xy12akRrOWQydnl4UWluQnFJUmZQNU01VDg3R2liTG5PVlVyZjdyYjRDc1Y1emF0RWplMllVQzRjR1VraHBYR0lfUHZaTWp2eVIxUk95R0dGUnE5WTV0WWpvY0g4cVpMdzF2ejkybmlFMUBNRVRBIn0&nolaunch=0" /installsource taggedmi /sessionid "{C9DCAE11-8309-46B9-BAD3-EDFBCFC98A24}"3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e592fa4.rbs
@PaxHeader
DropboxCleanup.exe
DropboxCrashHandler.exe
DropboxUpdate.exe
DropboxUpdateBroker.exe
DropboxUpdateHelper.msi
DropboxUpdateOnDemand.exe
goopdate.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_fr.dll
goopdateres_id.dll
goopdateres_it.dll
goopdateres_ja.dll
goopdateres_ko.dll
goopdateres_ms.dll
goopdateres_nl.dll
goopdateres_no.dll
goopdateres_pl.dll
goopdateres_pt-BR.dll
goopdateres_ru.dll
goopdateres_sv.dll
goopdateres_th.dll
goopdateres_uk.dll
goopdateres_zh-CN.dll
goopdateres_zh-TW.dll
npDropboxUpdate3.dll
psmachine.dll
psuser.dll
DropboxUpdateTaskMachineUA.job
memory/2892-69-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/2892-69-0x0000000002ED0000-0x0000000002ED1000-memory.dmp