31706a52240e474505ae3b82664dd68600fe94f1f8317c76dda073e76bf63cd2

General

Target
2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 284KB
Sample261113-hm4nnagy4y
SHA256 31706a52240e474505ae3b82664dd68600fe94f1f8317c76dda073e76bf63cd2
MD5 2576e9f33bc4e7275be925def19aade8
SHA1 4f64b728871d255a29530981e1926116d31b7152
SHA512 3a40378755a1b9d323b40da34a7d4eae2af7e9dff8f3a4fda2715d00598350010f7bcdcf3c135a9d393f190cd14ae32f89eb207294bd12a0008f46bfd3dcf4b0
SSDEEP 3072:7+zWDW6s4lpIx37CF+6aLK2IJqi6uS+gkDstXKJVof8JP2cd+ECGrjMzhOwTiG3n:FDTp9JVUE/jMzQG0G6tL8H6jf85r8fq
TLSH
T13754CE107791DE32C0D343B52566D772952D6630278F40B3BBD216AEB6312E2A639B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 3 IoCs

pid	Process
3320	Rundll32.exe
5480	Rundll32.exe
5480	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oxxobhaa.dll	2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\kdmnbhaa.dll	2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5044	sc.exe
1952	sc.exe
4416	sc.exe
4884	sc.exe
2588	sc.exe
3428	sc.exe
2340	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
3320	Rundll32.exe
5480	Rundll32.exe
5480	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4316	2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3320	4316	2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	90
PID 3320 wrote to memory of 5832	3320	Rundll32.exe	91
PID 3320 wrote to memory of 5692	3320	Rundll32.exe	92
PID 3320 wrote to memory of 2340	3320	Rundll32.exe	93
PID 3320 wrote to memory of 3428	3320	Rundll32.exe	94
PID 3320 wrote to memory of 5044	3320	Rundll32.exe	99
PID 3320 wrote to memory of 1952	3320	Rundll32.exe	100
PID 3320 wrote to memory of 4884	3320	Rundll32.exe	101
PID 3320 wrote to memory of 4416	3320	Rundll32.exe	102
PID 3320 wrote to memory of 4316	3320	Rundll32.exe	89
PID 3320 wrote to memory of 5832	3320	Rundll32.exe	91
PID 3320 wrote to memory of 5692	3320	Rundll32.exe	92
PID 3320 wrote to memory of 2340	3320	Rundll32.exe	93
PID 3320 wrote to memory of 3428	3320	Rundll32.exe	94
PID 5692 wrote to memory of 5912	5692	net.exe	107
PID 5832 wrote to memory of 1332	5832	net.exe	109
PID 3320 wrote to memory of 2588	3320	Rundll32.exe	110
PID 4316 wrote to memory of 5480	4316	2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_2576e9f33bc4e7275be925def19aade8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\kdmnbhaa.dll Exbcute
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3428
- - C:\Windows\SysWOW64\sc.exe
    sc stop ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc delete ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1952
- - C:\Windows\SysWOW64\sc.exe
    sc stop 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc delete 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4416
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2588
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\oxxobhaa.dll Exbcute
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

5152.tmp

Path C:\Users\Admin\AppData\Local\Temp\5152.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmnbhaa.dll

Path C:\Windows\SysWOW64\kdmnbhaa.dll
Size 77KB
SHA256 813f58b2ddb2903cee6a2579c00e3873d6c5513cbbe155c5799bd30320310d5d
MD5 b97e049f9767a35c57915bc2acf65f8a
SHA1 4a65c7d19c21a433e97a29f433ee23f6abd24532
SHA512 5d12853958347ee076e3e5c759dced358cfdc42af53213466aa2596ae9644fb84e0dff70dfb1bac1b91910352532a0763f549ce65d4ac47141d001a522550291
SSDEEP 1536:vlK++4wtsBhVWN6Qtjx37nCF+6aLK2IJqi6uS7qgkDstXGPprd9cqCmh6DY5atOp:vlpIx37CF+6aLK2IJqi6uS+gkDstXKJV
TLSH
T194733A206392DE32C4C707B56625D373993E16302B9F80736B92169FB6202D3A635F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oxxobhaa.dll

Path C:\Windows\SysWOW64\oxxobhaa.dll
Size 23KB
SHA256 d70b4aa975add0cefe6b39bb574cb436f67a463d1a5aff955ac5272fb30b6d9c
MD5 79787a4abaf078130511f0b634c29b3c
SHA1 115c9e688b4e7d7fda8fbdfcc25ab3e4eab750df
SHA512 9540e33827b137a319b13ce3742b6c3223d73e43612ec28300c8a32128bf5e43b3c3ae772839f4a585e2aadefc21a76c4feb2b4cf8170ed971c5d951ebe6b06f
SSDEEP 384:ZUtGj5OJboT6Q8Sc+Gp0Wn0rRRFsSW/bMrMR9CHom5M:Z9uCf8JPCrpAzMKCHZ
TLSH
T1A4B2E629F75DEE31E09240B572A5AE3E645C2A30138F60E7F7C34E5555342E1A27AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4316-4-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/4316-24-0x0000000000120000-0x0000000000147000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads