Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 12:12
General
- Target 2026-08-02_105ddada257b8f5bb37a64a1039c10ac_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 914KB
- Sample260802-pc961sseqc
- SHA256 7aed8c7d2b1c50aa23d357026dbf6787b5b61dde8b3d997855a5176fd24fbb3f
Malware Config
Signatures
- Detects executables packed with unregistered version of .NET Reactor 64 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_105ddada257b8f5bb37a64a1039c10ac_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_105ddada257b8f5bb37a64a1039c10ac_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1956-0-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1956-1-0x0000000004F20000-0x000000000508C000-memory.dmp
memory/1956-2-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1956-3-0x0000000005090000-0x0000000005634000-memory.dmp
memory/1956-4-0x0000000004D30000-0x0000000004E9A000-memory.dmp
memory/1956-5-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1956-7-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-31-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-59-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-57-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-37-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-35-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-33-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-29-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-27-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-25-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-23-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-21-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-19-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-17-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-15-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-13-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-11-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-9-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-6-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-93-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-99-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-127-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-131-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-129-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-125-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-123-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-121-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-119-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-117-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-115-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-113-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-111-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-109-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-107-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-105-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-103-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-101-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-97-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-95-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-91-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-89-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-87-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-85-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-83-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-81-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-79-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-77-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-75-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-73-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-71-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-69-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-67-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-65-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-64-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-61-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-55-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-54-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-51-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-49-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-47-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-45-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-43-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-41-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-39-0x0000000004D30000-0x0000000004E95000-memory.dmp
memory/1956-1999-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1956-2698-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1956-3126-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1956-4253-0x0000000005640000-0x00000000056D2000-memory.dmp