Analysis
- max time kernel
41s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 12:45
General
- Target 2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.7MB
- Sample260422-py2f1afv7p
- SHA256 b50c0dc51dea6b723cd1010b62129c958927b0e657098dc67e617e7669dfab9b
Malware Config
Signatures
- Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detects executables packed with SmartAssembly 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 5 IoCs
Detects SmartAssembly .NET packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XtbDs3RjKr.bat"2⤵
-
C:\Windows\SysWOW64\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
-
C:\Users\Admin\NetHood\spoolsv.exe"C:\Users\Admin\NetHood\spoolsv.exe"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\NetHood\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\apppatch\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\NetHood\spoolsv.exe"C:\Users\Admin\NetHood\spoolsv.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\apppatch\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\3D Objects\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\3D Objects\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\apppatch\dwm.exe"C:\Windows\apppatch\dwm.exe"1⤵
-
C:\Windows\Fonts\Idle.exe"C:\Windows\Fonts\Idle.exe"1⤵
-
C:\Users\Admin\3D Objects\spoolsv.exe"C:\Users\Admin\3D Objects\spoolsv.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
RCXC64A.tmp
XtbDs3RjKr.bat
__PSScriptPolicyTest_1h3gmss0.k2t.ps1
spoolsv.exe
memory/816-13074-0x0000000006700000-0x000000000674C000-memory.dmp
memory/816-23240-0x0000000007680000-0x000000000769E000-memory.dmp
memory/816-23198-0x00000000076A0000-0x00000000076D2000-memory.dmp
memory/816-23241-0x00000000078E0000-0x0000000007983000-memory.dmp
memory/816-23215-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/816-12866-0x0000000006610000-0x000000000662E000-memory.dmp
memory/816-7437-0x0000000005E90000-0x0000000005EB2000-memory.dmp
memory/816-6793-0x00000000056A0000-0x0000000005CC8000-memory.dmp
memory/816-7520-0x0000000006010000-0x0000000006364000-memory.dmp
memory/816-7438-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/816-6767-0x0000000005020000-0x0000000005056000-memory.dmp
memory/2268-23949-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/2848-52-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-22-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-82-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-120-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-130-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-128-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-126-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-124-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-122-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-118-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-116-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-114-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-112-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-110-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-108-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-106-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-104-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-102-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-100-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-98-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-96-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-94-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-92-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-90-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-88-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-86-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-84-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-80-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-78-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-76-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-74-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-72-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-70-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-66-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-64-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-62-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-60-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-58-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-54-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-56-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-50-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-48-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-46-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-42-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-40-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-38-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-36-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-26-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-24-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-68-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-20-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-19-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-32-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-12-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-10-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-9-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-6-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-1426-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-1619-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-1824-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-5228-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-5229-0x0000000002840000-0x000000000285C000-memory.dmp
memory/2848-5230-0x0000000002870000-0x00000000028C0000-memory.dmp
memory/2848-5231-0x00000000028D0000-0x00000000028D8000-memory.dmp
memory/2848-5232-0x0000000006220000-0x0000000006230000-memory.dmp
memory/2848-5234-0x0000000006260000-0x0000000006268000-memory.dmp
memory/2848-5233-0x00000000062E0000-0x00000000062F6000-memory.dmp
memory/2848-5235-0x0000000006300000-0x0000000006310000-memory.dmp
memory/2848-5236-0x0000000006720000-0x000000000672A000-memory.dmp
memory/2848-5237-0x0000000006750000-0x000000000675C000-memory.dmp
memory/2848-5238-0x0000000006760000-0x0000000006772000-memory.dmp
memory/2848-5239-0x0000000006880000-0x0000000006DAC000-memory.dmp
memory/2848-5242-0x0000000006850000-0x000000000685A000-memory.dmp
memory/2848-5244-0x0000000007030000-0x000000000703C000-memory.dmp
memory/2848-5245-0x0000000007050000-0x00000000070E2000-memory.dmp
memory/2848-5243-0x0000000006860000-0x0000000006868000-memory.dmp
memory/2848-5241-0x0000000006800000-0x000000000680C000-memory.dmp
memory/2848-5240-0x00000000067F0000-0x00000000067FC000-memory.dmp
memory/2848-5246-0x00000000071F0000-0x00000000071FC000-memory.dmp
memory/2848-5247-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-5250-0x0000000007380000-0x00000000073E6000-memory.dmp
memory/2848-6702-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-44-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-34-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-30-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-28-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-14-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-16-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-5-0x0000000005AF0000-0x0000000005D64000-memory.dmp
memory/2848-4-0x0000000005AF0000-0x0000000005D6A000-memory.dmp
memory/2848-7073-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-0-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/2848-1-0x0000000005280000-0x00000000054FC000-memory.dmp
memory/2848-3-0x0000000005540000-0x0000000005AE4000-memory.dmp
memory/2848-2-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/3412-23941-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/4272-23808-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/4712-24014-0x0000000070590000-0x00000000705DC000-memory.dmp