Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.5MB
- Sample260711-e1yssabv9k
- SHA256 cfc61e3ba0b0e0ea4976ea77cfa4f96697008d7e73738fd99daf3d0cadf61c72
- MD5 85447898e31dca120bcef16641494275
- SHA1 0de66c5ec1883acd3f3acae427a46ccd9ae9d2dd
- SHA512 5dfd5fb6d8fa36c6f5f6a2aabc019464542cc781f4652763db6bf21bc02413f0282b68f5adbfcb90d610c8c16d696adab6d294c1f8bb661829c4b114963282e3
- SSDEEP 24576:gk70TrcyeyR9qENt2NaLfGWQYDYV1n0CHOX2ik/1hzSSB+eOnw7pmHP8PMW3Zu6Y:gkQTALyPqRaLfGtz1nGXM1RSSB+Nnw7e
- TLSH T1D67523203A90D133D4B6083581E7DE660A786061A7BAD3D7FB8C2FB56F613D2653A0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with SmartAssembly 64 IoCs
resource yara_rule behavioral2/memory/4460-1-0x0000000005060000-0x00000000051F8000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-5-0x00000000057C0000-0x0000000005956000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-8-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-40-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-84-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-81-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-109-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-133-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-131-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-129-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-127-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-125-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-123-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-121-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-119-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-117-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-115-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-113-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-111-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-107-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-105-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-103-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-102-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-99-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-97-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-95-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-93-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-91-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-89-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-87-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-85-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-79-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-77-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-75-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-73-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-69-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-66-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-71-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-64-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-62-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-60-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-58-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-56-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-54-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-52-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-50-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-48-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-46-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-44-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-42-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-36-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-34-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-32-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-30-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-28-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-26-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-25-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-39-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-22-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-20-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-18-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-14-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-12-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4460-10-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly - Detects executables packed with unregistered version of .NET Reactor 64 IoCs
resource yara_rule behavioral2/memory/4460-1-0x0000000005060000-0x00000000051F8000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-5-0x00000000057C0000-0x0000000005956000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-8-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-40-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-84-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-81-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-109-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-133-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-131-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-129-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-127-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-125-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-123-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-121-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-119-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-117-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-115-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-113-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-111-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-107-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-105-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-103-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-102-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-99-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-97-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-95-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-93-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-91-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-89-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-87-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-85-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-79-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-77-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-75-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-73-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-69-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-66-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-71-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-64-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-62-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-60-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-58-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-56-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-54-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-52-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-50-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-48-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-46-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-44-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-42-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-36-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-34-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-32-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-30-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-28-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-26-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-25-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-39-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-22-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-20-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-18-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-14-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-12-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4460-10-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor - Detects executables referencing many base64-encoded IR and analysis tools names 64 IoCs
resource yara_rule behavioral2/memory/4460-1-0x0000000005060000-0x00000000051F8000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-5-0x00000000057C0000-0x0000000005956000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-8-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-40-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-84-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-81-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-109-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-133-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-131-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-129-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-127-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-125-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-123-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-121-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-119-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-117-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-115-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-113-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-111-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-107-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-105-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-103-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-102-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-99-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-97-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-95-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-93-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-91-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-89-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-87-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-85-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-79-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-77-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-75-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-73-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-69-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-66-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-71-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-64-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-62-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-60-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-58-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-56-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-54-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-52-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-50-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-48-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-46-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-44-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-42-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-36-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-34-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-32-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-30-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-28-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-26-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-25-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-39-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-22-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-20-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-18-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-14-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-12-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded behavioral2/memory/4460-10-0x00000000057C0000-0x0000000005951000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded - .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/4460-1-0x0000000005060000-0x00000000051F8000-memory.dmp net_reactor behavioral2/memory/4460-5-0x00000000057C0000-0x0000000005956000-memory.dmp net_reactor behavioral2/memory/4460-8-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-40-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-84-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-81-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-109-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-133-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-131-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-129-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-127-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-125-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-123-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-121-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-119-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-117-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-115-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-113-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-111-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-107-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-105-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-103-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-102-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-99-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-97-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-95-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-93-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-91-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-89-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-87-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-85-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-79-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-77-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-75-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-73-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-69-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-66-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-71-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-64-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-62-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-60-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-58-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-56-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-54-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-52-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-50-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-48-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-46-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-44-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-42-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-36-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-34-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-32-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-30-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-28-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-26-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-25-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-39-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-22-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-20-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-18-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-14-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-12-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor behavioral2/memory/4460-10-0x00000000057C0000-0x0000000005951000-memory.dmp net_reactor - SmartAssembly .NET packer 64 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule behavioral2/memory/4460-1-0x0000000005060000-0x00000000051F8000-memory.dmp SmartAssembly behavioral2/memory/4460-5-0x00000000057C0000-0x0000000005956000-memory.dmp SmartAssembly behavioral2/memory/4460-8-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-40-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-84-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-81-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-109-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-133-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-131-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-129-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-127-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-125-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-123-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-121-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-119-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-117-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-115-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-113-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-111-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-107-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-105-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-103-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-102-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-99-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-97-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-95-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-93-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-91-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-89-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-87-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-85-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-79-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-77-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-75-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-73-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-69-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-66-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-71-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-64-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-62-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-60-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-58-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-56-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-54-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-52-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-50-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-48-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-46-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-44-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-42-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-36-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-34-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-32-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-30-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-28-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-26-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-25-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-39-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-22-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-20-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-18-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-14-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-12-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly behavioral2/memory/4460-10-0x00000000057C0000-0x0000000005951000-memory.dmp SmartAssembly - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4460 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4460