Analysis
- max time kernel
86s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 04:34
General
- Target 2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.7MB
- Sample260714-e7fwjset6m
- SHA256 cadcbd888163b825c3b23a8e531d836ad4afa44a8e95b382abc600fc1987d619
Malware Config
Signatures
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 3 IoCs
- Detects executables packed with SmartAssembly 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- SmartAssembly .NET packer 5 IoCs
Detects SmartAssembly .NET packer.
- Drops file in Windows directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQEvZAPO2s.bat"2⤵
-
C:\Windows\SysWOW64\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
-
C:\Windows\CbsTemp\csrss.exe"C:\Windows\CbsTemp\csrss.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5496bbf1-4253-4d09-a185-e4ebd5b94d77.vbs"4⤵
-
C:\Windows\CbsTemp\csrss.exeC:\Windows\CbsTemp\csrss.exe5⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b00224e1-7ec9-4a0c-9ce9-f5594ef42768.vbs"4⤵
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Containers\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Containers\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\CbsTemp\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\CbsTemp\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\CbsTemp\csrss.exe"C:\Windows\CbsTemp\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Containers\lsass.exe"C:\Windows\Containers\lsass.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
5496bbf1-4253-4d09-a185-e4ebd5b94d77.vbs
__PSScriptPolicyTest_1twakygo.zcd.ps1
b00224e1-7ec9-4a0c-9ce9-f5594ef42768.vbs
yQEvZAPO2s.bat
csrss.exe
lsass.exe
memory/1168-17278-0x0000000007430000-0x00000000074D3000-memory.dmp
memory/1168-17209-0x0000000007410000-0x0000000007430000-memory.dmp
memory/1168-17189-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/1168-15748-0x00000000062F0000-0x000000000633C000-memory.dmp
memory/1168-15747-0x0000000006240000-0x000000000625E000-memory.dmp
memory/1912-89-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-5236-0x0000000006590000-0x000000000659A000-memory.dmp
memory/1912-113-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-111-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-109-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-107-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-105-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-103-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-99-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-97-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-95-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-93-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-91-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-0-0x0000000074462000-0x0000000074463000-memory.dmp
memory/1912-87-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-85-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-83-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-81-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-79-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-77-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-76-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-73-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-69-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-67-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-65-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-63-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-61-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-60-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-57-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-53-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-50-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-47-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-45-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-43-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-41-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-39-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-37-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-35-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-33-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-31-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-29-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-26-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-21-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-18-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-16-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-27-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-12-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-10-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-8-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-2248-0x0000000074462000-0x0000000074463000-memory.dmp
memory/1912-2249-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-5228-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-5229-0x0000000004C70000-0x0000000004C8C000-memory.dmp
memory/1912-5230-0x0000000004CA0000-0x0000000004CF0000-memory.dmp
memory/1912-5232-0x00000000064C0000-0x00000000064D0000-memory.dmp
memory/1912-5231-0x0000000004D00000-0x0000000004D08000-memory.dmp
memory/1912-5233-0x0000000006520000-0x0000000006536000-memory.dmp
memory/1912-5235-0x0000000006540000-0x0000000006550000-memory.dmp
memory/1912-5234-0x0000000006500000-0x0000000006508000-memory.dmp
memory/1912-115-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-5237-0x00000000068C0000-0x00000000068CC000-memory.dmp
memory/1912-5238-0x00000000068D0000-0x00000000068E2000-memory.dmp
memory/1912-5239-0x0000000006900000-0x0000000006E2C000-memory.dmp
memory/1912-5240-0x0000000006E90000-0x0000000006E9C000-memory.dmp
memory/1912-5241-0x0000000006EA0000-0x0000000006EAC000-memory.dmp
memory/1912-5244-0x0000000007280000-0x000000000728C000-memory.dmp
memory/1912-5243-0x0000000007270000-0x0000000007278000-memory.dmp
memory/1912-5242-0x0000000007260000-0x000000000726A000-memory.dmp
memory/1912-5245-0x0000000007290000-0x0000000007322000-memory.dmp
memory/1912-5247-0x0000000007370000-0x000000000737C000-memory.dmp
memory/1912-5246-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-5249-0x0000000007390000-0x00000000073F6000-memory.dmp
memory/1912-117-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-120-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-7839-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-8633-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-1-0x00000000053D0000-0x000000000564C000-memory.dmp
memory/1912-2-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-3-0x0000000005650000-0x0000000005C0A000-memory.dmp
memory/1912-4-0x0000000005C10000-0x0000000005E8A000-memory.dmp
memory/1912-122-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-125-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-5-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-15746-0x0000000074450000-0x0000000074C0C000-memory.dmp
memory/1912-127-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-129-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-6-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-14-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-131-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-123-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-22-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-24-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-101-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-51-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-55-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1912-71-0x0000000005C10000-0x0000000005E84000-memory.dmp
memory/1948-15736-0x0000000006700000-0x0000000006A5B000-memory.dmp
memory/1948-18101-0x0000000007F30000-0x0000000007FC6000-memory.dmp
memory/1948-17226-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/2004-17267-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/2004-9472-0x0000000005900000-0x0000000005F4A000-memory.dmp
memory/3352-17426-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/3772-17323-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/4608-13521-0x0000000006030000-0x0000000006096000-memory.dmp
memory/4608-13237-0x0000000005930000-0x0000000005952000-memory.dmp
memory/4608-17160-0x0000000006CE0000-0x0000000006D16000-memory.dmp
memory/4608-17178-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/4684-17558-0x0000000008310000-0x000000000898C000-memory.dmp
memory/4684-17291-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/4684-17882-0x0000000007CC0000-0x0000000007CCA000-memory.dmp
memory/4684-17568-0x0000000006F80000-0x0000000006F9A000-memory.dmp
memory/5148-17385-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/5168-17341-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/5212-17376-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/5880-17284-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/6584-17305-0x000000006F5F0000-0x000000006F63C000-memory.dmp
memory/6584-8809-0x0000000002660000-0x0000000002696000-memory.dmp