Analysis
- max time kernel
49s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 744KB
- Sample261027-bfbkzazzds
- SHA256 4a753eba6adc2aaa79a19916519603734a096a370096c0d68e3ce26ceb76c11e
- MD5 fdb8bc43e9b61e38ac0d848473738014
- SHA1 91df8c10e85afa059077dfe7e24aa1bb8e9739b7
- SHA512 291835c565bc93261bc7ee4314e2563b8e62a7eab2bd3af79eaa946d9147d7e9a6becb6fa2fdc786ff003e82ed65ff8271537fc9a1712265f61c61cee7188a53
- SSDEEP 12288:nS7eWy9aMgfqtbTzLhKgVENqF4B6BtIsct49I6bOsqwwNL6AaJt0UDb:nQNfMvzYQENNBVgFuR5y
- TLSH T11CF40118B700CD72D7D6013671A5CBB24A2E363D179F94B3BBCA2A46B6603D17A3471B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Rundll32.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Rundll32.exe - Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral1/files/0x001200000001e595-50.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 55 IoCs
resource yara_rule behavioral1/memory/1328-1-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-10-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-5-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-4-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-16-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-17-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-22-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-23-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-40-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-41-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-9-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-6-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-11-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-53-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-54-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-55-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-58-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-59-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-60-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-62-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-63-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-68-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-70-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-73-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-75-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-77-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-79-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-81-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-83-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-85-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-87-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-92-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-93-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-96-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-97-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-98-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-99-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-100-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1328-109-0x0000000002200000-0x00000000032BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-124-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-126-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-134-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-131-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-132-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-129-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-128-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-127-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-130-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-133-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-139-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-140-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-141-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-142-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-143-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4608-145-0x0000000003AA0000-0x0000000004B5A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 56 IoCs
resource yara_rule behavioral1/memory/1328-1-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-10-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-5-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-4-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-16-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-17-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-22-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-23-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-40-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-41-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-9-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-6-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-11-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-53-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-54-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-55-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-58-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-59-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-60-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-62-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-63-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-68-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-70-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-73-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-75-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-77-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-79-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-81-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-83-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-85-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-87-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-92-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-93-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-96-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-97-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-98-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-99-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-100-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-109-0x0000000002200000-0x00000000032BA000-memory.dmp UPX behavioral1/memory/1328-123-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/4608-124-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-126-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-134-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-131-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-132-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-129-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-128-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-127-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-130-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-133-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-139-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-140-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-141-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-142-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-143-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX behavioral1/memory/4608-145-0x0000000003AA0000-0x0000000004B5A000-memory.dmp UPX - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4608 Rundll32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation Rundll32.exe - Disables service(s) 3 TTPs
- Loads dropped DLL 3 IoCs
pid Process 4664 Rundll32.exe 4608 Rundll32.exe 4608 Rundll32.exe - Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe" Rundll32.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Rundll32.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: Rundll32.exe File opened (read-only) \??\H: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\L: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\M: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\S: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\W: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\X: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\P: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Y: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\Q: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\E: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\K: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\T: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\F: Rundll32.exe File opened (read-only) \??\O: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\R: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\U: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\V: 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\E: Rundll32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mpngtgaa.dll 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\eoghtgaa.dll 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe -
resource yara_rule behavioral1/memory/1328-1-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-10-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-5-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-4-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-16-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-17-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-22-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-23-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-40-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-41-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-9-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-6-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-11-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-53-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-54-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-55-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-58-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-59-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-60-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-62-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-63-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-68-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-70-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-73-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-75-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-77-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-79-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-81-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-83-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-85-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-87-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-92-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-93-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-96-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-97-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-98-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-99-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-100-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/1328-109-0x0000000002200000-0x00000000032BA000-memory.dmp upx behavioral1/memory/4608-124-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-126-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-134-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-131-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-132-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-129-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-128-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-127-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-130-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-133-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-139-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-140-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-141-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-142-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-143-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx behavioral1/memory/4608-145-0x0000000003AA0000-0x0000000004B5A000-memory.dmp upx - Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\AAV\CDriver.sys Rundll32.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5874dd 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\e5919b8 Rundll32.exe - Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4160 sc.exe 2620 sc.exe 4564 sc.exe 4180 sc.exe 3368 sc.exe 1052 sc.exe 3564 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4664 Rundll32.exe 4608 Rundll32.exe 4608 Rundll32.exe 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 4608 Rundll32.exe 4608 Rundll32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 672 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 4664 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 85 PID 1328 wrote to memory of 800 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 9 PID 1328 wrote to memory of 808 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 10 PID 1328 wrote to memory of 500 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 14 PID 1328 wrote to memory of 2992 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 1328 wrote to memory of 3040 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 1328 wrote to memory of 2764 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 53 PID 1328 wrote to memory of 3276 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 56 PID 1328 wrote to memory of 3396 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 1328 wrote to memory of 3596 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 58 PID 1328 wrote to memory of 3688 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 1328 wrote to memory of 3756 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 1328 wrote to memory of 3836 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 1328 wrote to memory of 4024 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 62 PID 1328 wrote to memory of 4604 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 1328 wrote to memory of 2976 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 77 PID 1328 wrote to memory of 4664 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 85 PID 1328 wrote to memory of 4664 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 85 PID 4664 wrote to memory of 3360 4664 Rundll32.exe 86 PID 4664 wrote to memory of 3372 4664 Rundll32.exe 87 PID 4664 wrote to memory of 3564 4664 Rundll32.exe 88 PID 4664 wrote to memory of 1052 4664 Rundll32.exe 89 PID 4664 wrote to memory of 4180 4664 Rundll32.exe 94 PID 4664 wrote to memory of 4564 4664 Rundll32.exe 95 PID 4664 wrote to memory of 2620 4664 Rundll32.exe 96 PID 4664 wrote to memory of 4160 4664 Rundll32.exe 97 PID 4664 wrote to memory of 1328 4664 Rundll32.exe 84 PID 4664 wrote to memory of 3360 4664 Rundll32.exe 86 PID 4664 wrote to memory of 3372 4664 Rundll32.exe 87 PID 4664 wrote to memory of 3564 4664 Rundll32.exe 88 PID 4664 wrote to memory of 1052 4664 Rundll32.exe 89 PID 3360 wrote to memory of 1068 3360 net.exe 103 PID 3372 wrote to memory of 2000 3372 net.exe 104 PID 4664 wrote to memory of 3368 4664 Rundll32.exe 105 PID 1328 wrote to memory of 4608 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 107 PID 1328 wrote to memory of 800 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 9 PID 1328 wrote to memory of 808 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 10 PID 1328 wrote to memory of 500 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 14 PID 1328 wrote to memory of 2992 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 1328 wrote to memory of 3040 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 1328 wrote to memory of 2764 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 53 PID 1328 wrote to memory of 3276 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 56 PID 1328 wrote to memory of 3396 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 1328 wrote to memory of 3596 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 58 PID 1328 wrote to memory of 3688 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 1328 wrote to memory of 3756 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 1328 wrote to memory of 3836 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 PID 1328 wrote to memory of 4024 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 62 PID 1328 wrote to memory of 4604 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 65 PID 1328 wrote to memory of 2976 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 77 PID 1328 wrote to memory of 4608 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 107 PID 1328 wrote to memory of 4608 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 107 PID 1328 wrote to memory of 800 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 9 PID 1328 wrote to memory of 808 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 10 PID 1328 wrote to memory of 500 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 14 PID 1328 wrote to memory of 2992 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 50 PID 1328 wrote to memory of 3040 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 52 PID 1328 wrote to memory of 2764 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 53 PID 1328 wrote to memory of 3276 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 56 PID 1328 wrote to memory of 3396 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 57 PID 1328 wrote to memory of 3596 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 58 PID 1328 wrote to memory of 3688 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 59 PID 1328 wrote to memory of 3756 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 60 PID 1328 wrote to memory of 3836 1328 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Rundll32.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:500
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3040
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2764
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1328 -
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\mpngtgaa.dll Exxcute3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\net.exenet stop WinDefend4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend5⤵
- System Location Discovery: System Language Discovery
PID:1068
-
-
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc5⤵
- System Location Discovery: System Language Discovery
PID:2000
-
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3564
-
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\sc.exesc stop ZhuDongFangYu4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4180
-
-
C:\Windows\SysWOW64\sc.exesc delete ZhuDongFangYu4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4564
-
-
C:\Windows\SysWOW64\sc.exesc stop 360rp4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\SysWOW64\sc.exesc delete 360rp4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4160
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop PolicyAgent4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3368
-
-
-
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\eoghtgaa.dll Exucute3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Badlisted process makes network request
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:4608
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3396
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3596
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3688
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4604
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2976
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7C20.tmp
- Size 4.3MB
- SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
- MD5 6c7cdd25c2cb0073306eb22aebfc663f
- SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
- SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
- SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
- TLSH T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nwai.exe
- Size 65KB
- SHA256 e2c3292b6e2bf2acef56fa8713a86645c74f4de69c5e2ab8b4d17cea0b48081c
- MD5 88d86a954efbab0b7875c1958aeb3ab9
- SHA1 fc7e349eff941aa017e922565a94a940f41d3ffc
- SHA512 4f8b46b946641b860d770751a87fdcbfa8dea79cbee007abcfdfeb7cfe79cb6935697c801cf6b36cd11c6b16f75d1fb8fb73f42e013a3c9492a8a31d0aa63b60
- SSDEEP 1536:P+o8kgtpywVyIvDrS7sYEQPcxqmKllG93EgvvS9:nHgzosYncxqLGegvvS9
- TLSH T1C25302D50B8F496DD2E0817B97448C97DC29360F8ABBC4F91249FB197699D9323A02F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winfyiax.exe
- Size 65KB
- SHA256 00dabf042b121fc3496a86429b368dc15ed0ac2360be3e724905eb40e29f682c
- MD5 f2795ba874b41c2905404c4e85e7b3b4
- SHA1 ec3fe04730a5084448e733bfc1b01b00bb72b34d
- SHA512 a2bde469c29b57fc54c0a1d34890cdcd907a543f5bab8a91a92cfbb0a3a0d2fef192a178392d28acd76339de4b15b6252b94a66e10713199cafa0953bccaf0db
- SSDEEP 1536:gZgSr+qdaiuYzDYYwCZ+YGTE6cVElbWF5smR:gZTzDbwvEKYv
- TLSH T13453020240AE178FD56AB8F1FDBB4D2641E04AEE2871DC48B9AD5737C876E60C8AA111
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winltghrl.exe
- Size 65KB
- SHA256 b795d05e230d292c60aac7b8b54f4f21d90f0d500528c30112c3b56cbed005a2
- MD5 e91c3169e206be968c1944a566ae6651
- SHA1 9926fae20fea45bbc8ee146e82279d308f31091a
- SHA512 451bdf1646dedac9db04c646fabd17ab5b76ab9e1b45334410d687ef44307f0bc65c6acf0cb75060bbb1ac77b626d7cd31bef4ab77d6d0519b1afaebdc8e987c
- SSDEEP 1536:M1aNI7Z/x6oUU5dBsIBDpkW5quyPIez2S61oBsyfwWX6KSZkwq:M1Rl/BdisibRaSVB9pX6K9
- TLSH T15553015C76344657FB37EEBD8BC7C40A15DC256400E1DE9E3E784B55FC8A462208CAEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wjvkve.exe
- Size 65KB
- SHA256 ea733cf5c9653bd3d72093249bc4260878798d136d6805ea73c6c2f341650147
- MD5 627c2ea1d6eccc5e7f9d6e1da37a5f1c
- SHA1 5d7c4968dd3b368aee82ccba84300d8c226c1ae1
- SHA512 5c0632517e86105dc4cc69d31db40df388648f463c727d7c9a9e8c9e1baf4b69c548c973381eaeafce822e7e16cdc380c4123eb3c8dcc7d35bd432eccdccf8f7
- SSDEEP 1536:X9a0qs055+N8TjpywOz6MjIKaaAkH5SfPVU9VAr4:X/qs05Q8vFSfzWPaC4
- TLSH T1D45301025249F5A0EDB7FBB1ECCFEAC4FC8961D9F9BC07099931995164BF190107882C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 a9b2a1a1f0d119ef7baf59aed6999a28f4bc3c5008193c004d409e231ec798c6
- MD5 d7b701bb1f39c19aa5766501b75126e8
- SHA1 9f2a3a2eed35537deec2dbd5d649e53de1c819e3
- SHA512 adffe692700e37e381204a6017e7225222d2a06dfe14003e96defcae55a9ba6e46a648d147598eabcfdb0374df7609e75bcaec80378316f7cefd1a2cfb8c78a3
- TLSH T19CD05E0E4FDD11AD9046002E3178D4C2723D9F11D8321F4C9039A74168686D9FF7E2AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\eoghtgaa.dll
- Size 22KB
- SHA256 6415356e1598e10aa4cbadae4bddef9d3b66beba7d2fcdadc581e747d7ec5b9b
- MD5 eb26752ac1f113c9b91cf26ff63eeb08
- SHA1 25a16e8db408b5421b2059c2d589700cd6982b2c
- SHA512 dd49bd2243bd409aa34e0e887208b480ca714e8636ac200300a3b4c4fb7289b76d7bf5cb7ce4ed5ae02a0f5cb5d1fa0a01ab0c1ecb946add2de7a318a0377329
- SSDEEP 384:0NiMxbWGetnZOlb0Htg0RRReNVrQ2YMR9CHomh:0hI2b+RKVvXCH
- TLSH T1B7A2D429A759DE70F0D240B53179AE7A285C2931178FA0D7F7C34F5266382E1A636F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mpngtgaa.dll
- Size 75KB
- SHA256 d487262d60a39473351162bbca85308528c197af0aca6127044e9672efc6d881
- MD5 f3612075a0b4bacd5a0a7e20060c962d
- SHA1 bab56594588126a8194459bbbd4370539155c0a4
- SHA512 2bc1840127bd2845b451f0ed64fe05cc3f8ac0702eed035a87ddb7a3ebc18c2213c2784a9b521d49dc38b407575fcea01cfe317aa701a51591b60071d3af9fa7
- SSDEEP 1536:o/tLZTbwxtpVVQMmWrSQ7mwH/ii8rd9cqCmh6DY5atOXPQdq:o1E7fSQ7mwfiiQJVGq
- TLSH T184733A00E711CE32CBC705376112CB718A2E763C3B5F69736B962B1ABA616D9B578313
- MD5 SHA1 SHA512 SSDEEP TLSH