Analysis
- max time kernel
149s - max time network
96s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 01:59
General
- Target 2026-06-30_fb6d1eeecfca5bdf225643b2dfc0958d_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 23.1MB
- Sample260701-cefnzaes2w
- SHA256 732529bbc7f64b2e0bd5f3c93b2dab9fa117f28ea0cd832a52ea0b0d17553a68
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 64 IoCs
Inno Setup installer
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_fb6d1eeecfca5bdf225643b2dfc0958d_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_fb6d1eeecfca5bdf225643b2dfc0958d_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5144-0-0x0000000074CD2000-0x0000000074CD3000-memory.dmp
memory/5144-1-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-2-0x000000000CB30000-0x000000000E278000-memory.dmp
memory/5144-3-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-4-0x0000000009240000-0x00000000097FA000-memory.dmp
memory/5144-5-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-6-0x000000000E280000-0x000000000F9C6000-memory.dmp
memory/5144-7-0x0000000006BF0000-0x0000000006C82000-memory.dmp
memory/5144-8-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-16-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-18-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-12-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-13-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-9-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-19-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-22-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-24-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-25-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-34-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-28-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-32-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-40-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-38-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-30-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-41-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-46-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-35-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-47-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-49-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-51-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-44-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-55-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-57-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-53-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-59-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-61-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-63-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-65-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-67-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-69-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-71-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-73-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-75-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-77-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-79-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-81-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-83-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-85-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-87-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-89-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-91-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-93-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-95-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-97-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-99-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-101-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-103-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-105-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-107-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-109-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-111-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-113-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-115-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-117-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-119-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-121-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-123-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-125-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-127-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-129-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-131-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-133-0x000000000E280000-0x000000000F9C0000-memory.dmp
memory/5144-1002-0x0000000074CD2000-0x0000000074CD3000-memory.dmp
memory/5144-1022-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-1670-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-1671-0x00000000020A0000-0x00000000020AA000-memory.dmp
memory/5144-1672-0x0000000009800000-0x000000000989C000-memory.dmp
memory/5144-1673-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-1674-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5144-1675-0x0000000074CC0000-0x000000007547C000-memory.dmp