85444a4ebedd75ad4b52a15bb3975209f451d43ae632dd3981c7b52d5e11b48f

General

Target
2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 376KB
Sample261023-2vb36aet8w
SHA256 85444a4ebedd75ad4b52a15bb3975209f451d43ae632dd3981c7b52d5e11b48f
MD5 ba97f266b56fb78502bbf8fd6327c485
SHA1 3a68e0a8c3e26fb97e6f444fe9381c3b7a939b2f
SHA512 aba68dc84ec4c7abcd7a88f3380aea0f741f64872f181b3a13efc16da42df2ede65b416148f30aac7f32e9d4efcc863b34dbcca69492d387a3446b9d8b0b827b
SSDEEP 3072:YL7q8fUjVkmmdzj7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:UfURk+pQJV
TLSH
T1C884F802B216E9F0D459857A1517A2F61BCA2D311E0FAC33B349BF2739711E16A25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244e8-27.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4664	Rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3480	system.exe
3980	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Loads dropped DLL 3 IoCs

pid	Process
2468	Rundll32.exe
4664	Rundll32.exe
4664	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\mgdhtgaa.dll	system.exe
File created	C:\Windows\SysWOW64\uxjiugaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\windows.exe	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4816	sc.exe
5104	sc.exe
1156	sc.exe
1736	sc.exe
2252	sc.exe
3532	sc.exe
3500	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
2468	Rundll32.exe
4664	Rundll32.exe
4664	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1696	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3980	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3480	1696	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	86
PID 3480 wrote to memory of 2468	3480	system.exe	87
PID 2468 wrote to memory of 752	2468	Rundll32.exe	88
PID 2468 wrote to memory of 5092	2468	Rundll32.exe	89
PID 2468 wrote to memory of 1156	2468	Rundll32.exe	90
PID 2468 wrote to memory of 5104	2468	Rundll32.exe	91
PID 2468 wrote to memory of 3500	2468	Rundll32.exe	96
PID 2468 wrote to memory of 3532	2468	Rundll32.exe	97
PID 2468 wrote to memory of 2252	2468	Rundll32.exe	98
PID 2468 wrote to memory of 1736	2468	Rundll32.exe	99
PID 2468 wrote to memory of 1696	2468	Rundll32.exe	85
PID 2468 wrote to memory of 3480	2468	Rundll32.exe	86
PID 2468 wrote to memory of 752	2468	Rundll32.exe	88
PID 2468 wrote to memory of 5092	2468	Rundll32.exe	89
PID 2468 wrote to memory of 1156	2468	Rundll32.exe	90
PID 2468 wrote to memory of 5104	2468	Rundll32.exe	91
PID 752 wrote to memory of 948	752	net.exe	104
PID 5092 wrote to memory of 4692	5092	net.exe	105
PID 2468 wrote to memory of 4816	2468	Rundll32.exe	106
PID 3480 wrote to memory of 4664	3480	system.exe	108
PID 1696 wrote to memory of 3980	1696	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\mgdhtgaa.dll Exbcute
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:948
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1156
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5104
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3500
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2252
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1736
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4816
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\uxjiugaa.dll Exbcute
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4664
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 224KB
SHA256 770bbe4cfa42047a633b48eb4a08cc7bc4f07bcb80af645a3d86a0f7602e2db0
MD5 f426cfdee2f2741063ff9c34f7899d03
SHA1 ca9bac1452f12d771fd74d0b59e2059af984a660
SHA512 be7fcfa5bb174e79f151d353bdbf8468c5d680793d0cd256f151ab8a11839d8af26f6a90a9ed98f6d387b9225bb0cbd41b8a7c19021aa79a05259ce54c1147a8
SSDEEP 1536:WTQVgd54vlVr43oQOdjceIBkPQ54vTgzQ:yL7q8fUjVkmmdz
TLSH
T1D0249603A216B1E4E82CC87B151771F62BCA2C715E0AAD177159BF3738721E47E16B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D0B.tmp
Size 4.3MB
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
TLSH
T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgdhtgaa.dll

Path C:\Windows\SysWOW64\mgdhtgaa.dll
Size 76KB
SHA256 4086a147b96e6072e723c8a81ddc90ed7215ee4a5940854b096a928f8e9d0808
MD5 d6dbfb326d0dc3591675b09ee7ad5f83
SHA1 3b422e8be6f9a61b01c59db9611835f80d647c34
SHA512 c574a2a07bea1e2648dc936fb1f7e89efddf474b58a7eae76984c64cb0439a9389e871b04c99e4f6b747e98da5105e1430273e3cd2ab594d83cc45e8f08d6afd
SSDEEP 1536:B2K++BBPZvwcN6uufTn7nCF+6aLK2IJqi6uS7qgkDstXGPprd9cqCmh6DY5atOXo:B2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJV
TLSH
T18F733A206392DE32C4C707B56526D7739A3E16302B9F80736B92169FB6202D3A535F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 142KB
SHA256 cb4c752f35e1c8a34a884fd056025440dc9af8d7c53f0d157736703c6b67c444
MD5 7546ef149abfd2d1f67370db4e4d51ee
SHA1 49d80249ca4186376f7987f16a1383a8a6b57008
SHA512 b0d95ff480c54a6bd183aaaa7d182d1fa55ab272b272fb0d94133537578220a1aa225f1f3df325c0e6b8eade5602b20a29ab9b0bd9b2783155cca1718fcd154e
SSDEEP 3072:y7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:hpQJV
TLSH
T12EE35C107791DE32C0C303B52565D7725A2D2630279F90B3BBD6169EBA302D2A639B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uxjiugaa.dll

Path C:\Windows\SysWOW64\uxjiugaa.dll
Size 23KB
SHA256 d85f9001abdf4bc35b26ef42e56d762b3e7fc92b146b2a8b116ebcd3b7797261
MD5 35f519f0f70994b3778acac00a42c948
SHA1 b2123bef906dbe73f66b2ac2148e5798bf95d904
SHA512 5238d5978967f73b1025064361c62b20186b792e731fe72a7620219c37a0f38d6c9083989edabe62bd4b59b25f000135d90f574741dcbb4c85f2dd91229ec8a7
SSDEEP 384:jUYGVwOcb1IDQ8Sc+GdWS0c6q7eRRcDy0W/bMHMR9CHomTW:j7u88JSxIDczMuCHy
TLSH
T168B2E628F74DEA72F09240B53565AE3E641C2931238F60E7F7C35E5156742E1A27AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-0-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1696-9-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/1696-30-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads