Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 12:03
General
- Target 2026-07-18_00c5054d635efe9ee84b4837725e79af_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 3.4MB
- Sample260718-n8a65aay5k
- SHA256 e337c76944fa0ca965482396f19a6eb76a12fd0ef5a3acb8ab6df6b63ab7c954
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_00c5054d635efe9ee84b4837725e79af_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_00c5054d635efe9ee84b4837725e79af_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4500-0-0x0000000074342000-0x0000000074343000-memory.dmp
memory/4500-1-0x0000000005B20000-0x0000000005EB8000-memory.dmp
memory/4500-2-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-3-0x0000000005EC0000-0x000000000647A000-memory.dmp
memory/4500-5-0x0000000005780000-0x0000000005B16000-memory.dmp
memory/4500-4-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-31-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-35-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-67-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-92-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-132-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-130-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-128-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-126-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-124-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-122-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-120-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-118-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-116-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-114-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-112-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-110-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-108-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-106-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-104-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-102-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-100-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-98-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-96-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-94-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-90-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-88-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-86-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-84-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-82-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-80-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-78-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-75-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-76-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-72-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-70-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-69-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-64-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-62-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-60-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-54-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-52-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-50-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-57-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-58-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-48-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-43-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-41-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-37-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-33-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-27-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-25-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-23-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-21-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-19-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-17-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-15-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-13-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-11-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-6-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-49-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-46-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-39-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-30-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-9-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-8-0x0000000005780000-0x0000000005B11000-memory.dmp
memory/4500-1827-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-1828-0x0000000006680000-0x0000000006712000-memory.dmp
memory/4500-1829-0x0000000006BD0000-0x0000000006C36000-memory.dmp
memory/4500-1830-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-1831-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-1832-0x0000000074342000-0x0000000074343000-memory.dmp
memory/4500-1833-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-1834-0x0000000006F50000-0x0000000006F5A000-memory.dmp
memory/4500-1835-0x0000000074330000-0x0000000074AEC000-memory.dmp
memory/4500-1836-0x0000000074330000-0x0000000074AEC000-memory.dmp