Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
25/05/2026, 14:36
General
- Target 2026-05-25_2d6ade1e6a63200d533ad3f81ef0100b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 465KB
- Sample260525-ry31yaev3s
- SHA256 8c22db294308a4ac6969542b920e929a989753410cfb33656a9a926aff1959dc
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_2d6ade1e6a63200d533ad3f81ef0100b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_2d6ade1e6a63200d533ad3f81ef0100b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\appmodel'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /tn appmodel /tr "C:\ProgramData\appmodel\appmodel.exe" /st 15:42 /du 23:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\appmodel\appmodel.exe"C:\ProgramData\appmodel\appmodel.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2788.tmp.cmd""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 63⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ehuxigwq.i2n.ps1
tmp2788.tmp.cmd
memory/2724-148-0x00000000049E0000-0x00000000049F0000-memory.dmp
memory/2724-154-0x0000000006F50000-0x0000000006F5A000-memory.dmp
memory/2724-159-0x0000000007120000-0x0000000007135000-memory.dmp
memory/2724-158-0x0000000007110000-0x000000000711E000-memory.dmp
memory/2724-156-0x00000000070E0000-0x00000000070F1000-memory.dmp
memory/2724-155-0x0000000007160000-0x00000000071F6000-memory.dmp
memory/2724-150-0x0000000006D60000-0x0000000006D7E000-memory.dmp
memory/2724-153-0x0000000006ED0000-0x0000000006EEA000-memory.dmp
memory/2724-152-0x0000000007510000-0x0000000007B8A000-memory.dmp
memory/2724-151-0x0000000006D90000-0x0000000006E34000-memory.dmp
memory/2724-160-0x0000000007220000-0x000000000723A000-memory.dmp
memory/2724-123-0x0000000005020000-0x000000000564A000-memory.dmp
memory/2724-135-0x0000000005650000-0x00000000059A7000-memory.dmp
memory/2724-139-0x0000000006140000-0x0000000006174000-memory.dmp
memory/2724-136-0x0000000005B80000-0x0000000005B9E000-memory.dmp
memory/2724-137-0x0000000005BA0000-0x0000000005BEC000-memory.dmp
memory/2724-140-0x0000000070BD0000-0x0000000070C1C000-memory.dmp
memory/2724-161-0x0000000007210000-0x0000000007218000-memory.dmp
memory/2724-127-0x0000000004E70000-0x0000000004ED6000-memory.dmp
memory/2724-128-0x0000000004EE0000-0x0000000004F46000-memory.dmp
memory/2724-126-0x0000000004CD0000-0x0000000004CF2000-memory.dmp
memory/2724-121-0x00000000049E0000-0x00000000049F0000-memory.dmp
memory/2724-122-0x00000000049E0000-0x00000000049F0000-memory.dmp
memory/2724-120-0x0000000002320000-0x0000000002356000-memory.dmp
memory/3792-86-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-5-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-76-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-74-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-70-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-68-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-66-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-64-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-62-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-58-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-56-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-54-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-52-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-50-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-48-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-46-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-44-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-42-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-38-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-36-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-32-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-30-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-28-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-26-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-24-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-20-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-18-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-16-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-14-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-12-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-98-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-10-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-8-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-80-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-6-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-78-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-40-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-34-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-22-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-82-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-84-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-0-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-88-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-90-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-92-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-94-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-96-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-100-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-102-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-104-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-106-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-138-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-108-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-149-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-110-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-112-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-147-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-117-0x0000000005270000-0x0000000005302000-memory.dmp
memory/3792-118-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-119-0x0000000002520000-0x0000000002521000-memory.dmp
memory/3792-114-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-116-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-72-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-157-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-60-0x0000000004C40000-0x0000000004C90000-memory.dmp
memory/3792-4-0x0000000004C40000-0x0000000004C98000-memory.dmp
memory/3792-3-0x0000000004CC0000-0x0000000005266000-memory.dmp
memory/3792-2-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/3792-1-0x0000000004BA0000-0x0000000004BF8000-memory.dmp
memory/4428-178-0x0000000002680000-0x00000000026D8000-memory.dmp
memory/4428-292-0x0000000005A90000-0x0000000005A9A000-memory.dmp