Analysis
- max time kernel
122s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 198KB
- Sample261014-pb8a2acv6l
- SHA256 16c8566501c6d65fbed20caa6236acd105d44e6fd8bcfbd17e03d48f2e9b31a9
- MD5 c9cbcebe533abb234f444624710dc77e
- SHA1 dab8078ded0e4044f6658b14e6d50684e691c944
- SHA512 afe472bf05dfe9f62c11208dbda18f90462947e6fe9e6e2772658b406134a7495eebee8efd6e4ff29419fba79f0e8dc29ac0fe6f22f8728e73d7051595844b07
- SSDEEP 3072:52LVpImRqLOUph/vrssiWjqHV8pd7xg2Pd7StUMnwX5c6LsXS5QRNd6:ELVpOjXYsJjqSTJVuF65HISoN
- TLSH T18214F114BAC5C4B2E00115F81456DB611B1EEC322FC696DB3B7AB66F5EB21C2923731E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral2/memory/2040-3-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-8-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-6-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-13-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-7-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-14-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-15-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-4-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-5-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-16-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-21-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-22-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-23-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-24-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-25-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-26-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-28-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-30-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-31-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-33-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-35-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-41-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-45-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-46-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-48-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-49-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-51-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-53-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-54-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-56-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-58-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-60-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-62-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-64-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-66-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-69-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-70-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-74-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2040-84-0x0000000000C20000-0x0000000001CDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 40 IoCs
resource yara_rule behavioral2/memory/2040-3-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-8-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-6-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-13-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-7-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-14-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-15-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-4-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-5-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-16-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-21-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-22-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-23-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-24-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-25-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-26-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-28-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-30-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-31-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-33-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-35-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-41-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-45-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-46-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-48-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-49-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-51-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-53-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-54-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-56-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-58-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-60-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-62-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-64-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-66-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-69-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-70-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-74-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-84-0x0000000000C20000-0x0000000001CDA000-memory.dmp UPX behavioral2/memory/2040-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Q: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\S: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\D: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\L: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\U: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Y: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\H: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\R: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\T: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\V: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\K: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\O: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\P: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\W: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\X: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Z: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification F:\autorun.inf 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe -
resource yara_rule behavioral2/memory/2040-3-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-8-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-6-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-13-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-7-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-14-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-15-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-4-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-5-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-16-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-21-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-22-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-23-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-24-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-25-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-26-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-28-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-30-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-31-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-33-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-35-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-41-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-45-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-46-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-48-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-49-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-51-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-53-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-54-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-56-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-58-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-60-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-62-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-64-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-66-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-69-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-70-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-74-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx behavioral2/memory/2040-84-0x0000000000C20000-0x0000000001CDA000-memory.dmp upx - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e58f9dc 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1172 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 15 PID 2040 wrote to memory of 2416 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 45 PID 2040 wrote to memory of 3148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 47 PID 2040 wrote to memory of 3460 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 2040 wrote to memory of 3300 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 2040 wrote to memory of 4360 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 2040 wrote to memory of 4404 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 2040 wrote to memory of 4464 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 2040 wrote to memory of 4748 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 2040 wrote to memory of 4968 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 64 PID 2040 wrote to memory of 5148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 2040 wrote to memory of 5260 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 2040 wrote to memory of 1456 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 80 PID 2040 wrote to memory of 2060 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 81 PID 2040 wrote to memory of 1252 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 82 PID 2040 wrote to memory of 1284 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 83 PID 2040 wrote to memory of 1212 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 84 PID 2040 wrote to memory of 1172 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 15 PID 2040 wrote to memory of 2416 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 45 PID 2040 wrote to memory of 3148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 47 PID 2040 wrote to memory of 3460 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 2040 wrote to memory of 3300 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 2040 wrote to memory of 4360 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 2040 wrote to memory of 4404 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 2040 wrote to memory of 4464 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 2040 wrote to memory of 4748 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 2040 wrote to memory of 4968 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 64 PID 2040 wrote to memory of 5148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 2040 wrote to memory of 5260 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 2040 wrote to memory of 1456 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 80 PID 2040 wrote to memory of 2060 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 81 PID 2040 wrote to memory of 1252 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 82 PID 2040 wrote to memory of 1284 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 83 PID 2040 wrote to memory of 1212 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 84 PID 2040 wrote to memory of 1172 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 15 PID 2040 wrote to memory of 2416 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 45 PID 2040 wrote to memory of 3148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 47 PID 2040 wrote to memory of 3460 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 2040 wrote to memory of 3300 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 2040 wrote to memory of 4360 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 2040 wrote to memory of 4404 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 2040 wrote to memory of 4464 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 2040 wrote to memory of 4748 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 2040 wrote to memory of 4968 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 64 PID 2040 wrote to memory of 5148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 2040 wrote to memory of 5260 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 2040 wrote to memory of 1456 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 80 PID 2040 wrote to memory of 2060 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 81 PID 2040 wrote to memory of 1252 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 82 PID 2040 wrote to memory of 1284 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 83 PID 2040 wrote to memory of 1212 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 84 PID 2040 wrote to memory of 1172 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 15 PID 2040 wrote to memory of 2416 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 45 PID 2040 wrote to memory of 3148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 47 PID 2040 wrote to memory of 3460 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 2040 wrote to memory of 3300 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 2040 wrote to memory of 4360 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 2040 wrote to memory of 4404 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 2040 wrote to memory of 4464 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 2040 wrote to memory of 4748 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 2040 wrote to memory of 4968 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 64 PID 2040 wrote to memory of 5148 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 2040 wrote to memory of 5260 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 2040 wrote to memory of 1456 2040 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 80 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3148
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3300
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4360
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4464
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4748
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000270;0000000000000274;1⤵PID:4968
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5148
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5260
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1456
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_c9cbcebe533abb234f444624710dc77e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2040
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:1252
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1284
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:1212
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\winyjbykl.exe
- Size 65KB
- SHA256 04b558fe1c39426b910ee7b5685ade49900a92a6a5a18398c9b7f9858f365da2
- MD5 c6e0820b370357c5578f68c99ea16d52
- SHA1 cee46115ddceea8c1f3fccb06e42a903f5c9c4f7
- SHA512 9cc700e60ea94ad580e43dbbd8d9fdd27c0d839d092acfe89f684561285e536eedbf4dc540412160687ccdcc254096a56592878433f6c97e90858a5e6c048881
- SSDEEP 1536:e8Sc3JwTjgxIUz3FaoqWjOoYI6Iq03WjmiJUJVuetnmx:CHgz3Faw6o1QR6g3x
- TLSH T1955302D9CA7FBD51C89EB538B67402FE9C41167256BBFCA076D026B402B4E531C62F42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\yrvhd.exe
- Size 97KB
- SHA256 dc85d68f72e4421c26916aa1e0f936c801957f07c5b7daa74d268625286bc256
- MD5 b6b75229749cc80a5df6e59175beb32c
- SHA1 9c3ad0f6bcc70336a250a8d95c7975a8d3d36c0d
- SHA512 35b446bef46083b2e134432021b293f0cf23d7f400d66c81fc2634f79afa244948424a184febc46c1efbd39c133048bd09b83ddcfb9f671a6148ae884a0f415f
- SSDEEP 1536:cFWtyGSuK05QYSqUqwrZhLpoxh4wjC7Qacw2g0ZuBLWQC6:cgtyGSyMqrwrZhLpoxpClcwHA4SQC
- TLSH T1B4A3128782641A2CC2A44F3B24C413D96F39701FAE98F76FD3095E099C5847D91DB677
- MD5 SHA1 SHA512 SSDEEP TLSH