85444a4ebedd75ad4b52a15bb3975209f451d43ae632dd3981c7b52d5e11b48f

General

Target
2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 376KB
Sample261023-2vb36aet8w
SHA256 85444a4ebedd75ad4b52a15bb3975209f451d43ae632dd3981c7b52d5e11b48f
MD5 ba97f266b56fb78502bbf8fd6327c485
SHA1 3a68e0a8c3e26fb97e6f444fe9381c3b7a939b2f
SHA512 aba68dc84ec4c7abcd7a88f3380aea0f741f64872f181b3a13efc16da42df2ede65b416148f30aac7f32e9d4efcc863b34dbcca69492d387a3446b9d8b0b827b
SSDEEP 3072:YL7q8fUjVkmmdzj7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:UfURk+pQJV
TLSH
T1C884F802B216E9F0D459857A1517A2F61BCA2D311E0FAC33B349BF2739711E16A25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5928	system.exe
1092	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Loads dropped DLL 3 IoCs

pid	Process
4832	Rundll32.exe
3436	Rundll32.exe
3436	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xquxxhaa.dll	system.exe
File created	C:\Windows\SysWOW64\system.exe	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\nulwxhaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\windows.exe	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4952	sc.exe
4764	sc.exe
252	sc.exe
3352	sc.exe
4324	sc.exe
4164	sc.exe
4400	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
4832	Rundll32.exe
3436	Rundll32.exe
3436	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4360	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1092	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 5928	4360	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	89
PID 5928 wrote to memory of 4832	5928	system.exe	90
PID 4832 wrote to memory of 4544	4832	Rundll32.exe	91
PID 4832 wrote to memory of 4212	4832	Rundll32.exe	92
PID 4832 wrote to memory of 4324	4832	Rundll32.exe	93
PID 4832 wrote to memory of 3352	4832	Rundll32.exe	94
PID 4832 wrote to memory of 4764	4832	Rundll32.exe	99
PID 4832 wrote to memory of 4164	4832	Rundll32.exe	100
PID 4832 wrote to memory of 4952	4832	Rundll32.exe	101
PID 4832 wrote to memory of 4400	4832	Rundll32.exe	102
PID 4832 wrote to memory of 4360	4832	Rundll32.exe	87
PID 4832 wrote to memory of 5928	4832	Rundll32.exe	89
PID 4832 wrote to memory of 4544	4832	Rundll32.exe	91
PID 4832 wrote to memory of 4212	4832	Rundll32.exe	92
PID 4832 wrote to memory of 4324	4832	Rundll32.exe	93
PID 4832 wrote to memory of 3352	4832	Rundll32.exe	94
PID 4832 wrote to memory of 4164	4832	Rundll32.exe	100
PID 4544 wrote to memory of 1820	4544	net.exe	107
PID 4212 wrote to memory of 3444	4212	net.exe	108
PID 4832 wrote to memory of 252	4832	Rundll32.exe	110
PID 5928 wrote to memory of 3436	5928	system.exe	112
PID 4360 wrote to memory of 1092	4360	2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\nulwxhaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1820
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4324
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3352
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4764
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4164
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4952
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:252
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\xquxxhaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1786.tmp

Path C:\Users\Admin\AppData\Local\Temp\1786.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 224KB
SHA256 770bbe4cfa42047a633b48eb4a08cc7bc4f07bcb80af645a3d86a0f7602e2db0
MD5 f426cfdee2f2741063ff9c34f7899d03
SHA1 ca9bac1452f12d771fd74d0b59e2059af984a660
SHA512 be7fcfa5bb174e79f151d353bdbf8468c5d680793d0cd256f151ab8a11839d8af26f6a90a9ed98f6d387b9225bb0cbd41b8a7c19021aa79a05259ce54c1147a8
SSDEEP 1536:WTQVgd54vlVr43oQOdjceIBkPQ54vTgzQ:yL7q8fUjVkmmdz
TLSH
T1D0249603A216B1E4E82CC87B151771F62BCA2C715E0AAD177159BF3738721E47E16B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nulwxhaa.dll

Path C:\Windows\SysWOW64\nulwxhaa.dll
Size 76KB
SHA256 4086a147b96e6072e723c8a81ddc90ed7215ee4a5940854b096a928f8e9d0808
MD5 d6dbfb326d0dc3591675b09ee7ad5f83
SHA1 3b422e8be6f9a61b01c59db9611835f80d647c34
SHA512 c574a2a07bea1e2648dc936fb1f7e89efddf474b58a7eae76984c64cb0439a9389e871b04c99e4f6b747e98da5105e1430273e3cd2ab594d83cc45e8f08d6afd
SSDEEP 1536:B2K++BBPZvwcN6uufTn7nCF+6aLK2IJqi6uS7qgkDstXGPprd9cqCmh6DY5atOXo:B2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJV
TLSH
T18F733A206392DE32C4C707B56526D7739A3E16302B9F80736B92169FB6202D3A535F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 142KB
SHA256 cb4c752f35e1c8a34a884fd056025440dc9af8d7c53f0d157736703c6b67c444
MD5 7546ef149abfd2d1f67370db4e4d51ee
SHA1 49d80249ca4186376f7987f16a1383a8a6b57008
SHA512 b0d95ff480c54a6bd183aaaa7d182d1fa55ab272b272fb0d94133537578220a1aa225f1f3df325c0e6b8eade5602b20a29ab9b0bd9b2783155cca1718fcd154e
SSDEEP 3072:y7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:hpQJV
TLSH
T12EE35C107791DE32C0C303B52565D7725A2D2630279F90B3BBD6169EBA302D2A639B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xquxxhaa.dll

Path C:\Windows\SysWOW64\xquxxhaa.dll
Size 23KB
SHA256 d85f9001abdf4bc35b26ef42e56d762b3e7fc92b146b2a8b116ebcd3b7797261
MD5 35f519f0f70994b3778acac00a42c948
SHA1 b2123bef906dbe73f66b2ac2148e5798bf95d904
SHA512 5238d5978967f73b1025064361c62b20186b792e731fe72a7620219c37a0f38d6c9083989edabe62bd4b59b25f000135d90f574741dcbb4c85f2dd91229ec8a7
SSDEEP 384:jUYGVwOcb1IDQ8Sc+GdWS0c6q7eRRcDy0W/bMHMR9CHomTW:j7u88JSxIDczMuCHy
TLSH
T168B2E628F74DEA72F09240B53565AE3E641C2931238F60E7F7C35E5156742E1A27AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4360-0-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4360-10-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/4360-30-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads