0ceac172b5af0c51a5f2e5c2beb2a3e9289832a92f21b0b4e5f5271bcea69cb3

Analysis

max time kernel
37s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260424-ne3dhsf181
SHA256 0ceac172b5af0c51a5f2e5c2beb2a3e9289832a92f21b0b4e5f5271bcea69cb3
MD5 e34cafe3fbb130824e8e3153693d1a20
SHA1 58b6b334978038025998585afcd45fd6d40a98f7
SHA512 d1c7d92b2c3529576640b16a68ae50370640be080708b3a04e49f6029f4cc13575c1c67b3c098a165096d71e93558d8add66cd40e8c1e72496c4746d5fa51d84
SSDEEP 49152:SkQTAFYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpM:SaF5CbhZcT2lvnDFpFW/twU7+M
TLSH
T12AA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5876	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5840	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5916	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5744	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5780	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5872	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6044	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5152	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5556	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5748	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6032	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5776	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5396	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6084	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7120	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8252	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8236	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9160	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9208	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	5624	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9224	5624	schtasks.exe	80

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/3048-5232-0x0000000006350000-0x0000000006360000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3048-5238-0x0000000007140000-0x000000000714A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3048-5246-0x0000000008960000-0x000000000896C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3048-5247-0x0000000008980000-0x000000000898C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3048-5249-0x00000000089B0000-0x00000000089BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3048-5251-0x0000000008C60000-0x0000000008C6A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3048-5256-0x0000000008F20000-0x0000000008F2A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3048-5232-0x0000000006350000-0x0000000006360000-memory.dmp	SmartAssembly
behavioral2/memory/3048-5238-0x0000000007140000-0x000000000714A000-memory.dmp	SmartAssembly
behavioral2/memory/3048-5246-0x0000000008960000-0x000000000896C000-memory.dmp	SmartAssembly
behavioral2/memory/3048-5247-0x0000000008980000-0x000000000898C000-memory.dmp	SmartAssembly
behavioral2/memory/3048-5249-0x00000000089B0000-0x00000000089BC000-memory.dmp	SmartAssembly
behavioral2/memory/3048-5251-0x0000000008C60000-0x0000000008C6A000-memory.dmp	SmartAssembly
behavioral2/memory/3048-5256-0x0000000008F20000-0x0000000008F2A000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5840	schtasks.exe
4952	schtasks.exe
3584	schtasks.exe
2540	schtasks.exe
3300	schtasks.exe
5748	schtasks.exe
4116	schtasks.exe
1036	schtasks.exe
3484	schtasks.exe
4448	schtasks.exe
9224	schtasks.exe
5876	schtasks.exe
5916	schtasks.exe
5780	schtasks.exe
3440	schtasks.exe
1636	schtasks.exe
4984	schtasks.exe
5556	schtasks.exe
848	schtasks.exe
6044	schtasks.exe
5152	schtasks.exe
988	schtasks.exe
7120	schtasks.exe
8236	schtasks.exe
9208	schtasks.exe
3288	schtasks.exe
5872	schtasks.exe
6084	schtasks.exe
6112	schtasks.exe
1952	schtasks.exe
2504	schtasks.exe
8252	schtasks.exe
9160	schtasks.exe
5776	schtasks.exe
2688	schtasks.exe
3344	schtasks.exe
4932	schtasks.exe
5744	schtasks.exe
2972	schtasks.exe
4320	schtasks.exe
1884	schtasks.exe
5396	schtasks.exe
1188	schtasks.exe
2044	schtasks.exe
6032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3048	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3048	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3048	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee" /sc ONLOGON /tr "'C:\Windows\it-IT\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6032

C:\Recovery\WindowsRE\sppsvc.exe
"C:\Recovery\WindowsRE\sppsvc.exe"
1⤵
PID:1344

C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe
"C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe"
1⤵
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Recovery\WindowsRE\SearchHost.exe
"C:\Recovery\WindowsRE\SearchHost.exe"
1⤵
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Users\Admin\services.exe
"C:\Users\Admin\services.exe"
1⤵
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Recovery\WindowsRE\winlogon.exe
"C:\Recovery\WindowsRE\winlogon.exe"
1⤵
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\it-IT\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Windows\it-IT\2026-04-24_e34cafe3fbb130824e8e3153693d1a20_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
PID:1252

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:5440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3344

C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\smss.exe
"C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\smss.exe"
1⤵
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Users\Admin\Favorites\Links\fontdrvhost.exe
"C:\Users\Admin\Favorites\Links\fontdrvhost.exe"
1⤵
PID:6244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Program Files\Mozilla Firefox\gmp-clearkey\Idle.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\Idle.exe"
1⤵
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9224

C:\Program Files (x86)\Common Files\Microsoft Shared\csrss.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\csrss.exe"
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe
Size 2.0MB
SHA256 0ceac172b5af0c51a5f2e5c2beb2a3e9289832a92f21b0b4e5f5271bcea69cb3
MD5 e34cafe3fbb130824e8e3153693d1a20
SHA1 58b6b334978038025998585afcd45fd6d40a98f7
SHA512 d1c7d92b2c3529576640b16a68ae50370640be080708b3a04e49f6029f4cc13575c1c67b3c098a165096d71e93558d8add66cd40e8c1e72496c4746d5fa51d84
SSDEEP 49152:SkQTAFYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpM:SaF5CbhZcT2lvnDFpFW/twU7+M
TLSH
T12AA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idle.exe

Path C:\Program Files\Mozilla Firefox\gmp-clearkey\Idle.exe
Size 1.7MB
SHA256 6e492f1ea967e4b2935ddaf06e73025cf5325efb7dac28da61d91466bf684dc3
MD5 225b1232b31199d17fd1c25e3719fbd1
SHA1 3915f4fee62611130030fbe8e262390b1a2f1a45
SHA512 56eea492ee3b050b15d4fb946181fd3133d1b4e6a8a60093ce9d4a9a73ea15ebd4f929a00be5e2971931815d8f57debc3e3ba14e2b3db417ad1b73f3198430e1
SSDEEP 49152:SkQTAFYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmLv:SaF5CbhZcT2lvnDFpFW/twv
TLSH
T1F885232470D0C4B2E5AA103588C6CB369A767073877ED5D7BADE72F12F603E1523A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3048-0-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-1-0x00000000054A0000-0x0000000005758000-memory.dmp

Download

memory/3048-2-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-3-0x0000000005760000-0x0000000005D06000-memory.dmp

Download

memory/3048-4-0x00000000051D0000-0x0000000005486000-memory.dmp

Download

memory/3048-5-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-6-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-12-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-16-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-18-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-24-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-23-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-20-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-15-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-10-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-8-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-42-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-34-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-32-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-30-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-52-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-48-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-46-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-44-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-40-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-38-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-36-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-28-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-26-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-56-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-62-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-87-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-90-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-89-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-84-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-82-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-80-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-78-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-76-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-74-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-72-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-71-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-68-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-66-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-64-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-60-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-54-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-50-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-58-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-92-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-104-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-107-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-110-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-108-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-102-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-100-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-94-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-98-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-96-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-112-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-130-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-128-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-126-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-124-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-122-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-120-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-118-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-116-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-114-0x00000000051D0000-0x0000000005481000-memory.dmp

Download

memory/3048-1119-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-1353-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-1584-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-5228-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-5229-0x0000000004BD0000-0x0000000004BEC000-memory.dmp

Download

memory/3048-5230-0x0000000004C00000-0x0000000004C50000-memory.dmp

Download

memory/3048-5231-0x0000000004C60000-0x0000000004C68000-memory.dmp

Download

memory/3048-5232-0x0000000006350000-0x0000000006360000-memory.dmp

Download

memory/3048-5233-0x0000000006390000-0x00000000063A6000-memory.dmp

Download

memory/3048-5234-0x00000000070D0000-0x00000000070D8000-memory.dmp

Download

memory/3048-5235-0x0000000007220000-0x0000000007232000-memory.dmp

Download

memory/3048-5236-0x00000000070E0000-0x00000000070E8000-memory.dmp

Download

memory/3048-5237-0x00000000071A0000-0x00000000071B0000-memory.dmp

Download

memory/3048-5238-0x0000000007140000-0x000000000714A000-memory.dmp

Download

memory/3048-5239-0x0000000007340000-0x00000000073D2000-memory.dmp

Download

memory/3048-5241-0x0000000007190000-0x000000000719C000-memory.dmp

Download

memory/3048-5242-0x00000000071C0000-0x00000000071C8000-memory.dmp

Download

memory/3048-5240-0x0000000007150000-0x0000000007158000-memory.dmp

Download

memory/3048-5244-0x00000000071E0000-0x00000000071F2000-memory.dmp

Download

memory/3048-5246-0x0000000008960000-0x000000000896C000-memory.dmp

Download

memory/3048-5245-0x00000000083E0000-0x000000000890C000-memory.dmp

Download

memory/3048-5247-0x0000000008980000-0x000000000898C000-memory.dmp

Download

memory/3048-5248-0x0000000008990000-0x000000000899C000-memory.dmp

Download

memory/3048-5249-0x00000000089B0000-0x00000000089BC000-memory.dmp

Download

memory/3048-5251-0x0000000008C60000-0x0000000008C6A000-memory.dmp

Download

memory/3048-5252-0x0000000008D70000-0x0000000008D7E000-memory.dmp

Download

memory/3048-5250-0x00000000089C0000-0x00000000089C8000-memory.dmp

Download

memory/3048-5257-0x0000000008DE0000-0x0000000008DEC000-memory.dmp

Download

memory/3048-5256-0x0000000008F20000-0x0000000008F2A000-memory.dmp

Download

memory/3048-5255-0x0000000008DD0000-0x0000000008DD8000-memory.dmp

Download

memory/3048-5254-0x0000000008DC0000-0x0000000008DC8000-memory.dmp

Download

memory/3048-5260-0x0000000008E30000-0x0000000008E96000-memory.dmp

Download

memory/3048-5253-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-7087-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/3048-7716-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download