Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 22:40
General
- Target 2026-07-20_f88cb4cbb9b71b6e26384d36cad54661_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 10.2MB
- Sample260720-2lqvysh151
- SHA256 f05eab3fb1eea9403d4e5617b73225cb4a78b939552313830e3a292c27cec333
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_f88cb4cbb9b71b6e26384d36cad54661_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f88cb4cbb9b71b6e26384d36cad54661_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 20722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2956 -ip 29561⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2956-0-0x0000000074DB2000-0x0000000074DB3000-memory.dmp
memory/2956-1-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-2-0x0000000007610000-0x0000000008028000-memory.dmp
memory/2956-3-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-5-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-4-0x0000000006BF0000-0x00000000071AA000-memory.dmp
memory/2956-6-0x0000000008030000-0x0000000008A48000-memory.dmp
memory/2956-7-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-10-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-8-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-15-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-19-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-25-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-26-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-23-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-20-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-16-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-13-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-30-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-32-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-40-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-36-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-64-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-77-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-78-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-105-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-106-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-110-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-118-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-124-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-132-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-130-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-128-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-126-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-122-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-120-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-116-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-114-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-112-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-108-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-102-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-100-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-98-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-96-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-94-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-90-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-289-0x0000000006AF0000-0x0000000006B82000-memory.dmp
memory/2956-290-0x00000000044F0000-0x00000000044FA000-memory.dmp
memory/2956-288-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-287-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-291-0x000000000FE20000-0x000000001186A000-memory.dmp
memory/2956-88-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-86-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-92-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-84-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-80-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-74-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-72-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-70-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-69-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-82-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-67-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-60-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-52-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-48-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-62-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-58-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-57-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-54-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-51-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-46-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-42-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-38-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-34-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-28-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-45-0x0000000008030000-0x0000000008A40000-memory.dmp
memory/2956-294-0x0000000074DB2000-0x0000000074DB3000-memory.dmp
memory/2956-295-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-298-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/2956-299-0x0000000074DA0000-0x000000007555C000-memory.dmp