Analysis
- max time kernel
16s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 06:13
General
- Target 2026-07-18_d2b7fe50022cb65c84dafd443233c1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.7MB
- Sample260718-gy31tsdy21
- SHA256 29cc11d02348b2e1c0d61ece1aad418c730cfe62592309c7edff566806de1300
Malware Config
Signatures
- Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Custom signatureDetects executables packed with SmartAssembly 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 5 IoCs
Detects SmartAssembly .NET packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_d2b7fe50022cb65c84dafd443233c1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_d2b7fe50022cb65c84dafd443233c1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Microsoft Office\Office16\csrss.exe"C:\Program Files\Microsoft Office\Office16\csrss.exe"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office16\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office16\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Microsoft Office\Office16\csrss.exe"C:\Program Files\Microsoft Office\Office16\csrss.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Default User\dllhost.exe"C:\Users\Default User\dllhost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"1⤵
-
C:\Recovery\WindowsRE\TextInputHost.exe"C:\Recovery\WindowsRE\TextInputHost.exe"1⤵
-
C:\Users\Default User\taskhostw.exe"C:\Users\Default User\taskhostw.exe"1⤵
-
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe"C:\Program Files\Windows Portable Devices\RuntimeBroker.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
csrss.exe
__PSScriptPolicyTest_vh2zjib2.wo1.ps1
memory/2216-112-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-34-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-2-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-3-0x00000000053D0000-0x0000000005974000-memory.dmp
memory/2216-4-0x0000000005980000-0x0000000005BFA000-memory.dmp
memory/2216-5-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-8-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-10-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-16-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-108-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-46-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-48-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-66-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-64-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-62-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-60-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-58-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-56-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-54-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-44-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-42-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-40-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-38-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-36-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-110-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-52-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-50-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-31-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-28-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-26-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-25-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-20-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-18-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-14-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-22-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-12-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-6-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-72-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-0-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-82-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-104-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-116-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-120-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-128-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-130-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-126-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-124-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-122-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-118-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-114-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-74-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-1-0x0000000005150000-0x00000000053CC000-memory.dmp
memory/2216-32-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-106-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-102-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-100-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-98-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-94-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-92-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-90-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-88-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-96-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-86-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-85-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-80-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-78-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-76-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-70-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-68-0x0000000005980000-0x0000000005BF4000-memory.dmp
memory/2216-1126-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-1307-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-1530-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-5228-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-5230-0x0000000002330000-0x0000000002380000-memory.dmp
memory/2216-5235-0x00000000061B0000-0x00000000061C0000-memory.dmp
memory/2216-5236-0x00000000065D0000-0x00000000065DA000-memory.dmp
memory/2216-5238-0x0000000006610000-0x0000000006622000-memory.dmp
memory/2216-5237-0x0000000006600000-0x000000000660C000-memory.dmp
memory/2216-5240-0x00000000066A0000-0x00000000066AC000-memory.dmp
memory/2216-5244-0x0000000006710000-0x000000000671C000-memory.dmp
memory/2216-5245-0x0000000006FE0000-0x0000000007072000-memory.dmp
memory/2216-5247-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-5250-0x00000000070E0000-0x0000000007146000-memory.dmp
memory/2216-5246-0x00000000070A0000-0x00000000070AC000-memory.dmp
memory/2216-5243-0x0000000006700000-0x0000000006708000-memory.dmp
memory/2216-5242-0x00000000066E0000-0x00000000066EA000-memory.dmp
memory/2216-5241-0x00000000066B0000-0x00000000066BC000-memory.dmp
memory/2216-5239-0x0000000006730000-0x0000000006C5C000-memory.dmp
memory/2216-5234-0x0000000006110000-0x0000000006118000-memory.dmp
memory/2216-5233-0x0000000006190000-0x00000000061A6000-memory.dmp
memory/2216-5232-0x00000000060D0000-0x00000000060E0000-memory.dmp
memory/2216-5231-0x0000000002390000-0x0000000002398000-memory.dmp
memory/2216-5229-0x0000000002300000-0x000000000231C000-memory.dmp
memory/2216-6739-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2216-7003-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/3252-8027-0x0000000005030000-0x0000000005066000-memory.dmp
memory/3252-16136-0x0000000006750000-0x000000000676E000-memory.dmp
memory/3252-16945-0x0000000006860000-0x00000000068AC000-memory.dmp
memory/4108-10318-0x0000000005930000-0x0000000005C84000-memory.dmp
memory/4112-8185-0x00000000052E0000-0x0000000005908000-memory.dmp
memory/4112-10053-0x0000000005910000-0x0000000005976000-memory.dmp
memory/4112-10052-0x0000000005200000-0x0000000005222000-memory.dmp