Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 22:56
General
- Target 2026-07-20_2833f7cf59b436d7bde2715c06af915b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 10.2MB
- Sample260720-2wtplagv3j
- SHA256 325dc3489b448d12cb1082cff4b8beb63f84c1563b4b2879de278403ef346e7f
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_2833f7cf59b436d7bde2715c06af915b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2833f7cf59b436d7bde2715c06af915b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 20522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3668 -ip 36681⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3668-0-0x0000000074C32000-0x0000000074C33000-memory.dmp
memory/3668-1-0x0000000007570000-0x0000000007F88000-memory.dmp
memory/3668-2-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-3-0x0000000006B50000-0x000000000710A000-memory.dmp
memory/3668-4-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-5-0x0000000007F90000-0x00000000089A8000-memory.dmp
memory/3668-7-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-6-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-9-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-12-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-16-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-14-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-20-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-24-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-22-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-18-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-26-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-11-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-28-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-32-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-30-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-36-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-38-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-40-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-44-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-43-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-48-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-50-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-47-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-56-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-54-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-58-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-52-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-62-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-64-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-68-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-67-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-70-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-60-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-34-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-72-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-74-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-78-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-76-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-82-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-84-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-81-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-88-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-90-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-86-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-94-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-92-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-96-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-98-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-100-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-102-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-105-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-106-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-108-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-110-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-112-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-114-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-116-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-118-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-122-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-124-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-126-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-130-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-128-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-132-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-120-0x0000000007F90000-0x00000000089A0000-memory.dmp
memory/3668-232-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-231-0x0000000074C32000-0x0000000074C33000-memory.dmp
memory/3668-289-0x0000000004540000-0x00000000045D2000-memory.dmp
memory/3668-290-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-291-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-292-0x0000000007280000-0x000000000728A000-memory.dmp
memory/3668-293-0x000000000FF60000-0x00000000119AA000-memory.dmp
memory/3668-296-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3668-297-0x0000000074C20000-0x00000000753DC000-memory.dmp