Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 10:44
General
- Target 2026-08-10_2a0827751c6963e20ef40c7ae2dcfdff_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.8MB
- Sample260810-msveds1zhy
- SHA256 7ab6bd9fe7a7e261e7a7d92301b8505364e0e7dd7d1bd50b565124ed38f70e80
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2a0827751c6963e20ef40c7ae2dcfdff_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2a0827751c6963e20ef40c7ae2dcfdff_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3552-0-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-1-0x00000000051B0000-0x000000000534C000-memory.dmp
memory/3552-2-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-3-0x0000000005350000-0x00000000058F4000-memory.dmp
memory/3552-4-0x0000000005010000-0x00000000051AE000-memory.dmp
memory/3552-5-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-6-0x0000000005A40000-0x0000000005AD2000-memory.dmp
memory/3552-7-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-8-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-16-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-14-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-48-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-46-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-64-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-62-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-60-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-58-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-56-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-54-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-52-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-50-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-44-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-42-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-40-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-38-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-36-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-34-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-32-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-28-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-26-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-22-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-21-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-18-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-30-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-12-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-24-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-10-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-9-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-74-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-87-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-89-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-117-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-131-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-135-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-133-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-129-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-127-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-125-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-123-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-121-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-119-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-115-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-113-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-105-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-101-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-99-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-97-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-95-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-93-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-91-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-111-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-109-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-107-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-103-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-85-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-84-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-82-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-80-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-78-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-76-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-70-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-68-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-72-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-66-0x0000000005010000-0x00000000051A5000-memory.dmp
memory/3552-194-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3552-235-0x0000000005DA0000-0x0000000005DA1000-memory.dmp
memory/3552-236-0x0000000008090000-0x0000000008664000-memory.dmp
memory/3552-237-0x0000000005F00000-0x0000000005F8E000-memory.dmp
memory/3552-238-0x0000000008660000-0x0000000008AEA000-memory.dmp