Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 02:56
General
- Target 2026-08-03_1772a3dc4f6fd8a6700bcc1476697692_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.1MB
- Sample260803-dfct5sbc53
- SHA256 50002c2df2712157a98042ca6e83b0d42362e9118ef78b2a24a07b3a6b7b321f
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_1772a3dc4f6fd8a6700bcc1476697692_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1772a3dc4f6fd8a6700bcc1476697692_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
style[1].css
memory/1812-0-0x0000000074112000-0x0000000074113000-memory.dmp
memory/1812-1-0x0000000005210000-0x0000000005326000-memory.dmp
memory/1812-2-0x0000000005320000-0x00000000058DA000-memory.dmp
memory/1812-3-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-4-0x0000000005010000-0x0000000005126000-memory.dmp
memory/1812-27-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-83-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-88-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-123-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-154-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-165-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-163-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-161-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-160-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-155-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-151-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-149-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-148-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-167-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-117-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-115-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-113-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-111-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-109-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-1063-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1065-0x00000000029E0000-0x0000000002A72000-memory.dmp
memory/1812-1064-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-107-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-105-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-104-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-1066-0x0000000005180000-0x000000000518A000-memory.dmp
memory/1812-101-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-99-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-121-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-86-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-84-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-78-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-70-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-68-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-60-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-58-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-56-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-49-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-46-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-44-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-42-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-40-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-36-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-39-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-34-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-33-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-90-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-81-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-77-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-75-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-72-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-67-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-65-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-62-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-55-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-53-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-50-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-30-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-28-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-22-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-18-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-16-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-14-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-13-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-10-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-1067-0x00000000074D0000-0x0000000007542000-memory.dmp
memory/1812-8-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-5-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-6-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-25-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-20-0x0000000005010000-0x000000000511E000-memory.dmp
memory/1812-1068-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1069-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1070-0x0000000074112000-0x0000000074113000-memory.dmp
memory/1812-1071-0x000000000CDB0000-0x000000000CE16000-memory.dmp
memory/1812-1073-0x000000000D020000-0x000000000D0D2000-memory.dmp
memory/1812-1074-0x000000000CFA0000-0x000000000CFC2000-memory.dmp
memory/1812-1075-0x000000000D100000-0x000000000D45B000-memory.dmp
memory/1812-1076-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1078-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1091-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1092-0x0000000074100000-0x00000000748BC000-memory.dmp
memory/1812-1093-0x0000000074100000-0x00000000748BC000-memory.dmp