Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 03:46
General
- Target 2026-07-23_287a276517991bd29e43f0095b3fd274_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 29.2MB
- Sample260723-ebsv8szhrc
- SHA256 1473860dfe885402228acd6eb4df315eaa554582c940c80905f6f703dc3c5a2b
Malware Config
Signatures
- Detects executables manipulated with Fody 2 IoCs
- Detects executables packed with unregistered version of .NET Reactor 2 IoCs
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_287a276517991bd29e43f0095b3fd274_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_287a276517991bd29e43f0095b3fd274_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4108-0-0x000000000A660000-0x000000000A670000-memory.dmp
memory/4108-1-0x000000000F990000-0x0000000011A90000-memory.dmp
memory/4108-2-0x000000000A660000-0x000000000A670000-memory.dmp
memory/4108-3-0x000000000A670000-0x000000000AC14000-memory.dmp
memory/4108-4-0x0000000014A90000-0x0000000016B8E000-memory.dmp
memory/4108-5-0x000000000A5C0000-0x000000000A652000-memory.dmp
memory/4108-6-0x000000000A660000-0x000000000A670000-memory.dmp
memory/4108-7-0x000000000B1E0000-0x000000000B290000-memory.dmp
memory/4108-8-0x000000000B2D0000-0x000000000B2F2000-memory.dmp
memory/4108-9-0x000000000B480000-0x000000000B48A000-memory.dmp
memory/4108-10-0x000000000A660000-0x000000000A670000-memory.dmp
memory/4108-11-0x0000000018260000-0x00000000182D6000-memory.dmp
memory/4108-12-0x0000000018200000-0x000000001821E000-memory.dmp
memory/4108-13-0x000000000A660000-0x000000000A670000-memory.dmp
memory/4108-15-0x000000000A660000-0x000000000A670000-memory.dmp