Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 09:27
General
- Target 2026-07-01_70e6ef4b986dbe7fdae8fd0a35e2558a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 4.7MB
- Sample260701-le15cacy4x
- SHA256 7c9f4ca4ceabfcc29fc90b85a9911a3bcc86d3df78ba8f2507655fe15f5310dd
Malware Config
Signatures
- Costura .NET executable packer 64 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_70e6ef4b986dbe7fdae8fd0a35e2558a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_70e6ef4b986dbe7fdae8fd0a35e2558a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4936-0-0x0000000074412000-0x0000000074413000-memory.dmp
memory/4936-1-0x00000000060A0000-0x00000000065E2000-memory.dmp
memory/4936-2-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-3-0x00000000065E0000-0x0000000006B9A000-memory.dmp
memory/4936-4-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-5-0x0000000006BA0000-0x00000000070E0000-memory.dmp
memory/4936-6-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-7-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-15-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-17-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-24-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-30-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-36-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-34-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-48-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-62-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-79-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-93-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-107-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-123-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-125-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-132-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-130-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-128-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-126-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-120-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-118-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-116-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-114-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-112-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-110-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-108-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-104-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-102-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-233-0x0000000005AA0000-0x0000000005B32000-memory.dmp
memory/4936-234-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-235-0x0000000005D00000-0x0000000005D0A000-memory.dmp
memory/4936-100-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-98-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-96-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-94-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-90-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-236-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-239-0x000000000A660000-0x000000000A6AC000-memory.dmp
memory/4936-240-0x000000000ABE0000-0x000000000AC9C000-memory.dmp
memory/4936-243-0x000000000AD60000-0x000000000AD6A000-memory.dmp
memory/4936-248-0x000000000AE90000-0x000000000AE9A000-memory.dmp
memory/4936-247-0x000000000AE80000-0x000000000AE88000-memory.dmp
memory/4936-246-0x000000000ADF0000-0x000000000AE12000-memory.dmp
memory/4936-245-0x000000000ADB0000-0x000000000ADEC000-memory.dmp
memory/4936-244-0x000000000AD70000-0x000000000AD8A000-memory.dmp
memory/4936-242-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-241-0x000000000ACD0000-0x000000000ACD8000-memory.dmp
memory/4936-238-0x000000000A2D0000-0x000000000A62B000-memory.dmp
memory/4936-237-0x000000000A260000-0x000000000A2CA000-memory.dmp
memory/4936-88-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-86-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-84-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-82-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-76-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-74-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-72-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-70-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-68-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-66-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-80-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-64-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-59-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-56-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-52-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-50-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-61-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-54-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-46-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-44-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-42-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-40-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-38-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-32-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-26-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-28-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-22-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-20-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-13-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-11-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-9-0x0000000006BA0000-0x00000000070DA000-memory.dmp
memory/4936-19-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-249-0x0000000074412000-0x0000000074413000-memory.dmp
memory/4936-250-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/4936-251-0x0000000074400000-0x0000000074BBC000-memory.dmp