Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 06:25
General
- Target 2026-06-27_6bf27f8102d2d76dc893189b4e40d526_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 2.9MB
- Sample260629-g6pheagy3p
- SHA256 4e9c06886f02a1725c51890ac6c7e1fe50fb6f922e71aa37dc23d49571272d80
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_6bf27f8102d2d76dc893189b4e40d526_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_6bf27f8102d2d76dc893189b4e40d526_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
pwl_096043b0186199323a2b12231cf636e3.bin
pwl_1668bc4058b43da705e3dbd43f67539c.bin
pwl_3421a6d9571ce3972ce53f1dce0aeed2.bin
pwl_4a37ddb6dd0d976cea1d1aa08fa13c10.bin
pwl_8514263bd75d2c726c78ba8a242098d5.bin
pwl_936559df9432ed2714ab76ce9b209db3.bin.part
pwl_948b087423b0dc02f01f286ca8b7ef58.bin.part
pwl_94d2325d438cb414e2918d63be269bee.bin.part
installed.version
memory/6064-81-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-69-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-6-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-7-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-10-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-26-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-30-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-32-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-56-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-54-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-66-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-84-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-87-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-106-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-116-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-132-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-130-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-128-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-126-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-124-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-122-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-120-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-118-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-114-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-112-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-110-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-108-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-104-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-102-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-100-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-98-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-96-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-92-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-64-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-88-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-94-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-82-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-5-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-78-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-76-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-74-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-72-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-4-0x0000000005510000-0x0000000005812000-memory.dmp
memory/6064-70-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-91-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-62-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-60-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-58-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-52-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-50-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-48-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-46-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-44-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-42-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-40-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-38-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-36-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-34-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-28-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-22-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-18-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-24-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-20-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-12-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-8-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-16-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-14-0x0000000005510000-0x000000000580E000-memory.dmp
memory/6064-1979-0x0000000074CC2000-0x0000000074CC3000-memory.dmp
memory/6064-1980-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-2749-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-2750-0x0000000006FC0000-0x0000000007220000-memory.dmp
memory/6064-2751-0x00000000076A0000-0x0000000007732000-memory.dmp
memory/6064-2752-0x0000000007740000-0x0000000007752000-memory.dmp
memory/6064-3-0x0000000005B20000-0x00000000060DA000-memory.dmp
memory/6064-2-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-2753-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-2755-0x000000000BB10000-0x000000000BB1E000-memory.dmp
memory/6064-2754-0x000000000BAD0000-0x000000000BB0E000-memory.dmp
memory/6064-2756-0x000000000CC80000-0x000000000CCBC000-memory.dmp
memory/6064-2757-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-3180-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-1-0x0000000005820000-0x0000000005B26000-memory.dmp
memory/6064-0-0x0000000074CC2000-0x0000000074CC3000-memory.dmp
memory/6064-3198-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/6064-3199-0x0000000074CB0000-0x000000007546C000-memory.dmp