Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 18:12
General
- Target 2026-07-09_086152be2b23d1fbec666d209156fddc_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.3MB
- Sample260709-ws8fpaf13t
- SHA256 28504e558a0d3d9e8f8f687c198026ec6262081813cd831674c1f01d431d63a7
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_086152be2b23d1fbec666d209156fddc_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_086152be2b23d1fbec666d209156fddc_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2568-0-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2568-1-0x0000000074BC2000-0x0000000074BC4000-memory.dmp
memory/2568-4-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-38-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-32-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-18-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-41-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-74-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-36-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-34-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-30-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-28-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-27-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-24-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-22-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-20-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-16-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-14-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-12-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-10-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-8-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-6-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-5-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-79-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-120-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-132-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-130-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-128-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-126-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-122-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-118-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-116-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-114-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-112-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-110-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-108-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-106-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-104-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-102-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-100-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-98-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-96-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-94-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-92-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-90-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-88-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-86-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-84-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-82-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-125-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-77-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-75-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-71-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-70-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-67-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-65-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-64-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-59-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-61-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-57-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-56-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-53-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-51-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-49-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-47-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-45-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-43-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-42-0x0000000004F20000-0x000000000507D000-memory.dmp
memory/2568-81-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-1933-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2568-2629-0x0000000074BC2000-0x0000000074BC4000-memory.dmp
memory/2568-2630-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4474-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4475-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4476-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4477-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4478-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4479-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4480-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4485-0x0000000074BC0000-0x00000000751E1000-memory.dmp
memory/2568-4486-0x0000000074BC0000-0x00000000751E1000-memory.dmp