Analysis
- max time kernel
122s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 190KB
- Sample261024-me662ahs8v
- SHA256 6fe67342d5fd45d54a6cea874b5211a69818bc5a6342576934a3c292f9d8e48f
- MD5 679d8c44fe4afcee983840cf8da293d1
- SHA1 0704396bec2ef4c8a2ee2ad1292475d0286171ae
- SHA512 21b98425d8d5d1fddf8643cd51fd22bc72e24a8490a2b0df898089212641bfba32277bbeac8f818667f2207e0189f8b79f366c7882ab9ae2d1d0670f7a4bcee5
- SSDEEP 3072:w8LVpImRqLOUph/FYlqoT7cF4086CeOaLs19CsuCnwX5c6LsXS5QRNd6:DLVpOjtYIoTIV86DOb19gC65HISoN
- TLSH T1E514F1157585C472E00310B82457DB650B5ABD222BD25ADB3BB6BB9F8F722C2C63730E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Custom signatureDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral2/memory/3616-2-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-5-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-11-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-10-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-8-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-6-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-12-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-9-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-4-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-7-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-18-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-17-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-23-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-24-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-25-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-26-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-29-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-30-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-31-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-32-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-35-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-34-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-38-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-42-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-44-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-46-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-47-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-49-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-51-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-50-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-59-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-61-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-63-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-65-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-66-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-67-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-70-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-75-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3616-76-0x0000000000BD0000-0x0000000001C8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - Custom signatureUPX dump on OEP (original entry point) 40 IoCs
resource yara_rule behavioral2/memory/3616-2-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-5-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-11-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-10-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-8-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-6-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-12-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-9-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-4-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-7-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-18-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-17-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-23-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-24-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-25-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-26-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-29-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-30-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-31-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-32-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-35-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-34-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-38-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-42-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-44-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-46-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-47-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-49-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-51-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-50-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-59-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-61-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-63-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-65-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-66-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-67-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-70-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-75-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-76-0x0000000000BD0000-0x0000000001C8A000-memory.dmp UPX behavioral2/memory/3616-85-0x0000000000400000-0x0000000000425000-memory.dmp UPX - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\R: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\U: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\V: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\D: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\H: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\L: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\P: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Q: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\S: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\M: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\O: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\T: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\W: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Z: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\X: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Y: 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification F:\autorun.inf 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe -
resource yara_rule behavioral2/memory/3616-2-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-5-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-11-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-10-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-8-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-6-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-12-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-9-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-4-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-7-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-18-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-17-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-23-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-24-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-25-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-26-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-29-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-30-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-31-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-32-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-35-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-34-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-38-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-42-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-44-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-46-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-47-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-49-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-51-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-50-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-59-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-61-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-63-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-65-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-66-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-67-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-70-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-75-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx behavioral2/memory/3616-76-0x0000000000BD0000-0x0000000001C8A000-memory.dmp upx - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e59529b 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 1172 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 16 PID 3616 wrote to memory of 2292 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 46 PID 3616 wrote to memory of 3168 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 49 PID 3616 wrote to memory of 3468 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 3616 wrote to memory of 3368 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 3616 wrote to memory of 4332 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 3616 wrote to memory of 4380 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 62 PID 3616 wrote to memory of 4396 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 3616 wrote to memory of 4684 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 3616 wrote to memory of 4988 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 3616 wrote to memory of 4924 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 67 PID 3616 wrote to memory of 5224 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 68 PID 3616 wrote to memory of 5268 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 69 PID 3616 wrote to memory of 5904 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 83 PID 3616 wrote to memory of 5064 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 84 PID 3616 wrote to memory of 6000 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 85 PID 3616 wrote to memory of 4580 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 86 PID 3616 wrote to memory of 1172 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 16 PID 3616 wrote to memory of 2292 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 46 PID 3616 wrote to memory of 3168 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 49 PID 3616 wrote to memory of 3468 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 3616 wrote to memory of 3368 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 3616 wrote to memory of 4332 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 3616 wrote to memory of 4380 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 62 PID 3616 wrote to memory of 4396 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 3616 wrote to memory of 4684 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 3616 wrote to memory of 4988 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 3616 wrote to memory of 4924 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 67 PID 3616 wrote to memory of 5224 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 68 PID 3616 wrote to memory of 5268 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 69 PID 3616 wrote to memory of 5904 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 83 PID 3616 wrote to memory of 5064 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 84 PID 3616 wrote to memory of 6000 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 85 PID 3616 wrote to memory of 4580 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 86 PID 3616 wrote to memory of 1172 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 16 PID 3616 wrote to memory of 2292 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 46 PID 3616 wrote to memory of 3168 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 49 PID 3616 wrote to memory of 3468 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 3616 wrote to memory of 3368 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 3616 wrote to memory of 4332 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 3616 wrote to memory of 4380 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 62 PID 3616 wrote to memory of 4396 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 3616 wrote to memory of 4684 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 3616 wrote to memory of 4988 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 3616 wrote to memory of 4924 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 67 PID 3616 wrote to memory of 5224 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 68 PID 3616 wrote to memory of 5268 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 69 PID 3616 wrote to memory of 5904 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 83 PID 3616 wrote to memory of 5064 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 84 PID 3616 wrote to memory of 6000 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 85 PID 3616 wrote to memory of 4580 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 86 PID 3616 wrote to memory of 1172 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 16 PID 3616 wrote to memory of 2292 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 46 PID 3616 wrote to memory of 3168 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 49 PID 3616 wrote to memory of 3468 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 3616 wrote to memory of 3368 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 3616 wrote to memory of 4332 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 3616 wrote to memory of 4380 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 62 PID 3616 wrote to memory of 4396 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 63 PID 3616 wrote to memory of 4684 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 3616 wrote to memory of 4988 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 66 PID 3616 wrote to memory of 4924 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 67 PID 3616 wrote to memory of 5224 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 68 PID 3616 wrote to memory of 5268 3616 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe 69 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3168
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3368
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4332
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4396
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4684
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4988
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4924
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5224
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5268
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5904
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_679d8c44fe4afcee983840cf8da293d1_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3616
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:6000
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4580
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rgcb.exe
- Size 65KB
- SHA256 d038273e15e4e58fa470c1f83ce1cc3e1bca4a0fe41cdfc4ccca5386bd84263f
- MD5 f806dedf06e7281d6da35c49ea3bdc42
- SHA1 a748bb5b28088fc8fd457f8f8b2bc2f32858eeca
- SHA512 e3f30b156c32ed38e84a6b4407d6933c979d871014fd1e26ce83e7bc543a52534dbad4871ad1f1299f15a52c3a1ebb59bb05a1dbc92d5210504c9695a9c658b0
- SSDEEP 1536:KZuFWxjlZy+5jbBlEPZzPNb1nzx45e5pn3RuSGKxZ2OBAm:KZ+w5ZDj1lEBzPNZzx45unSKxZBqm
- TLSH T17E5302926761036EFC09FE310219741EB0EF49A15E75FA037B4862968BAD8C07DDB571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\qffqot.exe
- Size 97KB
- SHA256 bce2f82ecbec0364f90cfc4b20e92326d5be5f7773a5395d005f771ef1d2f217
- MD5 1e6df20c8e4e0c24eb0469391f9437b0
- SHA1 c923f6915548eada0eb2b946cac9238b09fd35c8
- SHA512 e6ad54cdeceb4a395e525eddce34f7845ea91d9228e9398235a4f3be2c8ea81f26501b2a332874ae85641482dd3a6e0e65c98053e3a361ae4cd78a34a53803b2
- SSDEEP 1536:ogLXGRiEWPA61aCvFPIh6m0S+WvJIarMt4zop74j9r/6DWKnqSX:ogLoiEJ60CFXS+a+aw0opMVSZnJ
- TLSH T18EA3124E5255A6B8E2F3DDB9C7135224C56DA302C6DB97F3F14283CBE01E0E46E8563A
- MD5 SHA1 SHA512 SSDEEP TLSH