Analysis
- max time kernel
38s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 01:37
General
- Target 2026-07-30_01fcfe022710bd0d130efa7fb40d78aa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 2.0MB
- Sample260730-b1992azyax
- SHA256 6936d6a2449212657cd9660ee9f2e0569af0ec8e5f2661ed6556edb0958f0c7d
Malware Config
Signatures
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detects executables packed with SmartAssembly 7 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- SmartAssembly .NET packer 7 IoCs
Detects SmartAssembly .NET packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_01fcfe022710bd0d130efa7fb40d78aa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_01fcfe022710bd0d130efa7fb40d78aa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-30_01fcfe022710bd0d130efa7fb40d78aa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WUDFHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\SecurityHealthService.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SecurityHealthSystray.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QIW2eKjohd.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
-
C:\Windows.old\SecurityHealthService.exe"C:\Windows.old\SecurityHealthService.exe"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 10 /tr "'C:\Windows.old\SecurityHealthService.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Windows.old\SecurityHealthService.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 8 /tr "'C:\Windows.old\SecurityHealthService.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\SecurityHealthSystray.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Users\All Users\SecurityHealthSystray.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\SecurityHealthSystray.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Recovery\WindowsRE\WUDFHost.exe"C:\Recovery\WindowsRE\WUDFHost.exe"1⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e023764c-aa39-4307-8fa9-4981322ecb07.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da2ff0de-1304-47b6-b332-191a6dfbe071.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows.old\SecurityHealthService.exe"C:\Windows.old\SecurityHealthService.exe"1⤵
-
C:\Users\All Users\SecurityHealthSystray.exe"C:\Users\All Users\SecurityHealthSystray.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SecurityHealthSystray.exe
WUDFHost.exe
QIW2eKjohd.bat
__PSScriptPolicyTest_bxpebxyg.wr0.ps1
da2ff0de-1304-47b6-b332-191a6dfbe071.vbs
e023764c-aa39-4307-8fa9-4981322ecb07.vbs
memory/2724-15326-0x00000000061D0000-0x000000000652B000-memory.dmp
memory/2724-13504-0x0000000005FE0000-0x0000000006002000-memory.dmp
memory/2724-13505-0x0000000006080000-0x00000000060E6000-memory.dmp
memory/2724-9880-0x0000000005050000-0x0000000005086000-memory.dmp
memory/4072-18715-0x0000000005D10000-0x0000000005D2E000-memory.dmp
memory/4072-18796-0x00000000006C0000-0x000000000070C000-memory.dmp
memory/4072-10391-0x0000000004F40000-0x000000000558A000-memory.dmp
memory/4768-27-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-40-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-130-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-128-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-126-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-124-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-122-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-120-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-118-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-116-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-114-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-112-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-110-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-108-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-106-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-104-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-102-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-100-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-98-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-96-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-94-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-90-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-88-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-86-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-84-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-82-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-80-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-78-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-76-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-74-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-72-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-70-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-68-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-64-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-62-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-60-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-56-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-54-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-52-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-51-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-47-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-43-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-41-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-37-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-33-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-31-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-29-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-0-0x0000000074FB2000-0x0000000074FB3000-memory.dmp
memory/4768-44-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-36-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-25-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-23-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-132-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-21-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-1087-0x0000000074FB2000-0x0000000074FB3000-memory.dmp
memory/4768-13-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-7-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-6-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-1088-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-16-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-5229-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-5232-0x0000000004DA0000-0x0000000004DA8000-memory.dmp
memory/4768-5231-0x0000000004D40000-0x0000000004D90000-memory.dmp
memory/4768-5236-0x00000000067C0000-0x00000000067D2000-memory.dmp
memory/4768-5238-0x0000000006C70000-0x0000000006C80000-memory.dmp
memory/4768-5239-0x0000000006CB0000-0x0000000006D42000-memory.dmp
memory/4768-5241-0x0000000006C90000-0x0000000006C98000-memory.dmp
memory/4768-5245-0x0000000006DA0000-0x0000000006DB2000-memory.dmp
memory/4768-5243-0x0000000006D90000-0x0000000006D98000-memory.dmp
memory/4768-5242-0x0000000006D70000-0x0000000006D7C000-memory.dmp
memory/4768-5248-0x0000000008E60000-0x0000000008E6C000-memory.dmp
memory/4768-5251-0x0000000008EA0000-0x0000000008EA8000-memory.dmp
memory/4768-5257-0x0000000009AB0000-0x0000000009ABC000-memory.dmp
memory/4768-5260-0x0000000009AF0000-0x0000000009B56000-memory.dmp
memory/4768-5258-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-5256-0x0000000009BF0000-0x0000000009BFA000-memory.dmp
memory/4768-5255-0x0000000009AA0000-0x0000000009AA8000-memory.dmp
memory/4768-5254-0x0000000008F80000-0x0000000008F88000-memory.dmp
memory/4768-92-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-5253-0x0000000008F50000-0x0000000008F5E000-memory.dmp
memory/4768-5252-0x0000000008F40000-0x0000000008F4A000-memory.dmp
memory/4768-5250-0x0000000008E90000-0x0000000008E9C000-memory.dmp
memory/4768-5249-0x0000000008E70000-0x0000000008E7C000-memory.dmp
memory/4768-5247-0x0000000008E40000-0x0000000008E4C000-memory.dmp
memory/4768-5246-0x0000000009270000-0x000000000979C000-memory.dmp
memory/4768-5240-0x0000000006D60000-0x0000000006D6A000-memory.dmp
memory/4768-5237-0x0000000006800000-0x0000000006808000-memory.dmp
memory/4768-5235-0x00000000067B0000-0x00000000067B8000-memory.dmp
memory/4768-5234-0x0000000006770000-0x0000000006786000-memory.dmp
memory/4768-5233-0x0000000006760000-0x0000000006770000-memory.dmp
memory/4768-5230-0x0000000004D10000-0x0000000004D2C000-memory.dmp
memory/4768-7313-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-66-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-7828-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-58-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-49-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-17-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-20-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-9-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-11-0x0000000005280000-0x0000000005531000-memory.dmp
memory/4768-5-0x0000000005280000-0x0000000005536000-memory.dmp
memory/4768-16521-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-4-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4768-3-0x0000000005800000-0x0000000005DBA000-memory.dmp
memory/4768-1-0x0000000005540000-0x00000000057F8000-memory.dmp
memory/4768-2-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/4852-19580-0x0000000002F90000-0x0000000002FA2000-memory.dmp