Analysis
- max time kernel
150s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 01:41
General
- Target 2026-05-28_22b40057408f7be5feb8654621078deb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 22.2MB
- Sample260528-b4emjaez2x
- SHA256 12d82e21b467652509b798521b7ac4471122fd41ab4bb34349d84166de4684c1
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_22b40057408f7be5feb8654621078deb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_22b40057408f7be5feb8654621078deb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4804-0-0x00000000094C0000-0x00000000094D0000-memory.dmp
memory/4804-1-0x000000000D210000-0x000000000ED8C000-memory.dmp
memory/4804-2-0x00000000094C0000-0x00000000094D0000-memory.dmp
memory/4804-3-0x00000000094D0000-0x0000000009A76000-memory.dmp
memory/4804-4-0x000000000ED90000-0x0000000010908000-memory.dmp
memory/4804-6-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-8-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-5-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-12-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-10-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-14-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-16-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-18-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-21-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-22-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-24-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-26-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-28-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-31-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-32-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-34-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-36-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-38-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-40-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-45-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-42-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-48-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-53-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-54-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-56-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-50-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-46-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-58-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-62-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-68-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-70-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-72-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-65-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-66-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-61-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-78-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-81-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-83-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-87-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-89-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-92-0x00000000094C0000-0x00000000094D0000-memory.dmp
memory/4804-85-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-74-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-79-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-75-0x00000000094C0000-0x00000000094D0000-memory.dmp
memory/4804-103-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-106-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-109-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-116-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-115-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-124-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-126-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-130-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-132-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-128-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-120-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-118-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-123-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-113-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-111-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-100-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-105-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-99-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-95-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-96-0x000000000ED90000-0x0000000010904000-memory.dmp
memory/4804-91-0x000000000ED90000-0x0000000010904000-memory.dmp