Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/07/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.5MB
- Sample260711-e1yssabv9k
- SHA256 cfc61e3ba0b0e0ea4976ea77cfa4f96697008d7e73738fd99daf3d0cadf61c72
- MD5 85447898e31dca120bcef16641494275
- SHA1 0de66c5ec1883acd3f3acae427a46ccd9ae9d2dd
- SHA512 5dfd5fb6d8fa36c6f5f6a2aabc019464542cc781f4652763db6bf21bc02413f0282b68f5adbfcb90d610c8c16d696adab6d294c1f8bb661829c4b114963282e3
- SSDEEP 24576:gk70TrcyeyR9qENt2NaLfGWQYDYV1n0CHOX2ik/1hzSSB+eOnw7pmHP8PMW3Zu6Y:gkQTALyPqRaLfGtz1nGXM1RSSB+Nnw7e
- TLSH T1D67523203A90D133D4B6083581E7DE660A786061A7BAD3D7FB8C2FB56F613D2653A0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with SmartAssembly 64 IoCs
resource yara_rule behavioral1/memory/4692-1-0x00000000050C0000-0x0000000005258000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-4-0x0000000004F20000-0x00000000050B6000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-15-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-13-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-31-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-29-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-27-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-25-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-23-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-21-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-49-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-73-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-85-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-101-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-99-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-97-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-95-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-93-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-91-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-89-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-87-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-83-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-81-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-79-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-77-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-75-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-71-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-69-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-67-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-65-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-63-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-61-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-59-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-57-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-55-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-53-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-51-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-47-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-45-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-43-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-41-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-39-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-37-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-35-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-33-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-19-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-11-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-9-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-8-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-17-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-6-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-131-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-129-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-127-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-125-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-123-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-121-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-119-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-117-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-115-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-113-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-111-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-109-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/4692-105-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly - Detects executables packed with unregistered version of .NET Reactor 64 IoCs
resource yara_rule behavioral1/memory/4692-1-0x00000000050C0000-0x0000000005258000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-4-0x0000000004F20000-0x00000000050B6000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-15-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-13-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-31-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-29-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-27-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-25-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-23-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-21-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-49-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-73-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-85-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-101-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-99-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-97-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-95-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-93-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-91-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-89-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-87-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-83-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-81-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-79-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-77-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-75-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-71-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-69-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-67-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-65-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-63-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-61-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-59-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-57-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-55-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-53-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-51-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-47-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-45-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-43-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-41-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-39-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-37-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-35-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-33-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-19-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-11-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-9-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-8-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-17-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-6-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-131-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-129-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-127-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-125-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-123-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-121-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-119-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-117-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-115-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-113-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-111-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-109-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral1/memory/4692-105-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor - Detects executables referencing many base64-encoded IR and analysis tools names 64 IoCs
resource yara_rule behavioral1/memory/4692-1-0x00000000050C0000-0x0000000005258000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-4-0x0000000004F20000-0x00000000050B6000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-15-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-13-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-31-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-29-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-27-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-25-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-23-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-21-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-49-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-73-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-85-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-101-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-99-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-97-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-95-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-93-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-91-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-89-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-87-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-83-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-81-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-79-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-77-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-75-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-71-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-69-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-67-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-65-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-63-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-61-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-59-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-57-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-55-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-53-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-51-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-47-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-45-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-43-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-41-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-39-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-37-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-35-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-33-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-19-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-11-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-9-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-8-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-17-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-6-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-131-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-129-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-127-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-125-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-123-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-121-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-119-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-117-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-115-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-113-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-111-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-109-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral1/memory/4692-105-0x0000000004F20000-0x00000000050B1000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded - .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/4692-1-0x00000000050C0000-0x0000000005258000-memory.dmp net_reactor behavioral1/memory/4692-4-0x0000000004F20000-0x00000000050B6000-memory.dmp net_reactor behavioral1/memory/4692-15-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-13-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-31-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-29-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-27-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-25-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-23-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-21-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-49-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-73-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-85-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-101-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-99-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-97-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-95-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-93-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-91-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-89-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-87-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-83-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-81-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-79-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-77-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-75-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-71-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-69-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-67-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-65-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-63-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-61-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-59-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-57-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-55-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-53-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-51-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-47-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-45-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-43-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-41-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-39-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-37-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-35-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-33-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-19-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-11-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-9-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-8-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-17-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-6-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-131-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-129-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-127-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-125-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-123-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-121-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-119-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-117-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-115-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-113-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-111-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-109-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor behavioral1/memory/4692-105-0x0000000004F20000-0x00000000050B1000-memory.dmp net_reactor - SmartAssembly .NET packer 64 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule behavioral1/memory/4692-1-0x00000000050C0000-0x0000000005258000-memory.dmp SmartAssembly behavioral1/memory/4692-4-0x0000000004F20000-0x00000000050B6000-memory.dmp SmartAssembly behavioral1/memory/4692-15-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-13-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-31-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-29-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-27-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-25-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-23-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-21-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-49-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-73-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-85-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-101-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-99-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-97-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-95-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-93-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-91-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-89-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-87-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-83-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-81-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-79-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-77-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-75-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-71-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-69-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-67-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-65-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-63-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-61-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-59-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-57-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-55-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-53-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-51-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-47-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-45-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-43-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-41-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-39-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-37-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-35-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-33-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-19-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-11-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-9-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-8-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-17-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-6-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-131-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-129-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-127-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-125-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-123-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-121-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-119-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-117-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-115-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-113-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-111-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-109-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly behavioral1/memory/4692-105-0x0000000004F20000-0x00000000050B1000-memory.dmp SmartAssembly - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4692 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4692