Overview

overview

7

Static

static

3

2026-11-02...lc.exe

windows10-2004-x64

7

2026-11-02...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 21:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
  • Size 85KB
  • Sample261102-1bkerafv8m
  • SHA256 2f7a0ed9b8f6b4c74974cb9434f7571aac22973b573aa967393e92561addc542
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 32 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5416
    • C:\Users\Admin\AppData\Local\Temp\2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc​.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc​.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 7.1MB
        • SHA256 b72b90d7ef5e546a64a1dc2c3bcccffe8800ca50a1f870775db7b64bcf0bd476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
        • Size 4.6MB
        • SHA256 91a1de7bbbd0f4c7c92c33387052d5281613407b8e55a41b0db07433a91d112a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_click_helper.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
        • Size 1.6MB
        • SHA256 1f976bf8c7fb5e25af4761de11d88f5071213e6e84f2557ee0d849f5521d89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pwahelper.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
        • Size 1.4MB
        • SHA256 f292c0e0ad28d4a5cbc62cda2eba47cf28efe006a798a120cfc6e36c535c6b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX4FB7.tmp
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\RCX4FB7.tmp
        • Size 32KB
        • SHA256 2b3158800b57de3dcbba9ed8081c903e7951471373d6a16d5a9e9b7e6006aed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0e5a3e62.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\0e5a3e62.tmp
        • Size 1.4MB
        • SHA256 62dcbe560bfc8ccf4e13df67075340ff03415be6d8aca4e3453a8223f06489ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0e5a3e62.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\0e5a3e62.tmp
        • Size 1.4MB
        • SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc​.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-11-02_d66419bfaa1b7bad2d4a70b3b2376c8b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc​.exe
        • Size 53KB
        • SHA256 8a8d788b058502af1893a9b43939c3c75a3cfda3cce2fd68669eb519814cb78d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX3E62.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX3E62.tmp
        • Size 32KB
        • SHA256 a0767239e4f53a09018d90dfe2d55ac40c6536af911444aa56a7e6e45c8c7a07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download