5c34309422602bb0dd884895ab1e613103ac90078926eab241c3a9dc988157bc

General

Target
2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 376KB
Sample261017-2fdcns1sgw
SHA256 5c34309422602bb0dd884895ab1e613103ac90078926eab241c3a9dc988157bc
MD5 1bfffa06cdd8ddd2e0de12c3321dc77c
SHA1 5c66927ea4c0527b53df8be9f4db523d1ce23d69
SHA512 0bf7ddc1197867af896b765df5b24c37fa99a75e306221f6c8689dfefa5dd94c9a30e7b4eb0efe6faed6754007149606a62b18bedaefc23281b646799a063dfd
SSDEEP 3072:0L7q8fUjVkmmdzj7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:wfURk+pQJV
TLSH
T1DC84F802B216E9F0D459857A1517A2F61BCA2D311E0FAC33B349BF2739711E16A25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2388	system.exe
1988	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Loads dropped DLL 3 IoCs

pid	Process
3292	Rundll32.exe
4792	Rundll32.exe
4792	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\btbobhaa.dll	system.exe
File created	C:\Windows\SysWOW64\xxjpbhaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\windows.exe	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5368	sc.exe
4868	sc.exe
4316	sc.exe
4356	sc.exe
928	sc.exe
4388	sc.exe
1976	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
3292	Rundll32.exe
4792	Rundll32.exe
4792	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3108	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2388	3108	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89
PID 2388 wrote to memory of 3292	2388	system.exe	90
PID 3292 wrote to memory of 2344	3292	Rundll32.exe	91
PID 3292 wrote to memory of 4116	3292	Rundll32.exe	92
PID 3292 wrote to memory of 4868	3292	Rundll32.exe	93
PID 3292 wrote to memory of 5368	3292	Rundll32.exe	94
PID 3292 wrote to memory of 4316	3292	Rundll32.exe	99
PID 3292 wrote to memory of 4388	3292	Rundll32.exe	100
PID 3292 wrote to memory of 928	3292	Rundll32.exe	101
PID 3292 wrote to memory of 4356	3292	Rundll32.exe	102
PID 3292 wrote to memory of 3108	3292	Rundll32.exe	88
PID 3292 wrote to memory of 2388	3292	Rundll32.exe	89
PID 3292 wrote to memory of 2344	3292	Rundll32.exe	91
PID 3292 wrote to memory of 4116	3292	Rundll32.exe	92
PID 3292 wrote to memory of 4868	3292	Rundll32.exe	93
PID 3292 wrote to memory of 5368	3292	Rundll32.exe	94
PID 3292 wrote to memory of 4316	3292	Rundll32.exe	99
PID 4116 wrote to memory of 3172	4116	net.exe	107
PID 2344 wrote to memory of 1080	2344	net.exe	108
PID 3292 wrote to memory of 1976	3292	Rundll32.exe	109
PID 2388 wrote to memory of 4792	2388	system.exe	111
PID 3108 wrote to memory of 1988	3108	2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\btbobhaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4868
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5368
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4316
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4388
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:928
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4356
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1976
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\xxjpbhaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4792
- C:\Users\Admin\AppData\Local\Temp\2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-16_1bfffa06cdd8ddd2e0de12c3321dc77c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 224KB
SHA256 770bbe4cfa42047a633b48eb4a08cc7bc4f07bcb80af645a3d86a0f7602e2db0
MD5 f426cfdee2f2741063ff9c34f7899d03
SHA1 ca9bac1452f12d771fd74d0b59e2059af984a660
SHA512 be7fcfa5bb174e79f151d353bdbf8468c5d680793d0cd256f151ab8a11839d8af26f6a90a9ed98f6d387b9225bb0cbd41b8a7c19021aa79a05259ce54c1147a8
SSDEEP 1536:WTQVgd54vlVr43oQOdjceIBkPQ54vTgzQ:yL7q8fUjVkmmdz
TLSH
T1D0249603A216B1E4E82CC87B151771F62BCA2C715E0AAD177159BF3738721E47E16B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\54BD.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btbobhaa.dll

Path C:\Windows\SysWOW64\btbobhaa.dll
Size 76KB
SHA256 4086a147b96e6072e723c8a81ddc90ed7215ee4a5940854b096a928f8e9d0808
MD5 d6dbfb326d0dc3591675b09ee7ad5f83
SHA1 3b422e8be6f9a61b01c59db9611835f80d647c34
SHA512 c574a2a07bea1e2648dc936fb1f7e89efddf474b58a7eae76984c64cb0439a9389e871b04c99e4f6b747e98da5105e1430273e3cd2ab594d83cc45e8f08d6afd
SSDEEP 1536:B2K++BBPZvwcN6uufTn7nCF+6aLK2IJqi6uS7qgkDstXGPprd9cqCmh6DY5atOXo:B2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJV
TLSH
T18F733A206392DE32C4C707B56526D7739A3E16302B9F80736B92169FB6202D3A535F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 142KB
SHA256 cb4c752f35e1c8a34a884fd056025440dc9af8d7c53f0d157736703c6b67c444
MD5 7546ef149abfd2d1f67370db4e4d51ee
SHA1 49d80249ca4186376f7987f16a1383a8a6b57008
SHA512 b0d95ff480c54a6bd183aaaa7d182d1fa55ab272b272fb0d94133537578220a1aa225f1f3df325c0e6b8eade5602b20a29ab9b0bd9b2783155cca1718fcd154e
SSDEEP 3072:y7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:hpQJV
TLSH
T12EE35C107791DE32C0C303B52565D7725A2D2630279F90B3BBD6169EBA302D2A639B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxjpbhaa.dll

Path C:\Windows\SysWOW64\xxjpbhaa.dll
Size 23KB
SHA256 d85f9001abdf4bc35b26ef42e56d762b3e7fc92b146b2a8b116ebcd3b7797261
MD5 35f519f0f70994b3778acac00a42c948
SHA1 b2123bef906dbe73f66b2ac2148e5798bf95d904
SHA512 5238d5978967f73b1025064361c62b20186b792e731fe72a7620219c37a0f38d6c9083989edabe62bd4b59b25f000135d90f574741dcbb4c85f2dd91229ec8a7
SSDEEP 384:jUYGVwOcb1IDQ8Sc+GdWS0c6q7eRRcDy0W/bMHMR9CHomTW:j7u88JSxIDczMuCHy
TLSH
T168B2E628F74DEA72F09240B53565AE3E641C2931238F60E7F7C35E5156742E1A27AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3108-0-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3108-10-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/3108-30-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads