Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 22:56
General
- Target 2026-07-20_2833f7cf59b436d7bde2715c06af915b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 10.2MB
- Sample260720-2wtplagv3j
- SHA256 325dc3489b448d12cb1082cff4b8beb63f84c1563b4b2879de278403ef346e7f
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_2833f7cf59b436d7bde2715c06af915b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2833f7cf59b436d7bde2715c06af915b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 18162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2128 -ip 21281⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2128-0-0x00000000069F0000-0x0000000006A00000-memory.dmp
memory/2128-1-0x0000000007420000-0x0000000007E38000-memory.dmp
memory/2128-2-0x00000000069F0000-0x0000000006A00000-memory.dmp
memory/2128-3-0x0000000006A00000-0x0000000006FA4000-memory.dmp
memory/2128-4-0x0000000007E40000-0x0000000008858000-memory.dmp
memory/2128-8-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-6-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-5-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-12-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-10-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-16-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-20-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-22-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-28-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-34-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-38-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-42-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-36-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-32-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-30-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-26-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-24-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-18-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-14-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-40-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-48-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-50-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-46-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-44-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-56-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-80-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-90-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-85-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-78-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-72-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-71-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-69-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-76-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-74-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-66-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-64-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-63-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-60-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-58-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-53-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-54-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-95-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-104-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-108-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-112-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-118-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-116-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-114-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-110-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-106-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-102-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-100-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-98-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-96-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-92-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-88-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-86-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-82-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-122-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-120-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-125-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-130-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-126-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-128-0x0000000007E40000-0x0000000008850000-memory.dmp
memory/2128-217-0x00000000069F0000-0x0000000006A00000-memory.dmp
memory/2128-289-0x00000000069F0000-0x0000000006A00000-memory.dmp
memory/2128-288-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/2128-287-0x00000000069F0000-0x0000000006A00000-memory.dmp
memory/2128-286-0x0000000002920000-0x00000000029B2000-memory.dmp
memory/2128-290-0x0000000004180000-0x000000000418A000-memory.dmp
memory/2128-291-0x000000000F5D0000-0x000000001101A000-memory.dmp