Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 10:44
General
- Target 2026-08-10_2a0827751c6963e20ef40c7ae2dcfdff_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.8MB
- Sample260810-msveds1zhy
- SHA256 7ab6bd9fe7a7e261e7a7d92301b8505364e0e7dd7d1bd50b565124ed38f70e80
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2a0827751c6963e20ef40c7ae2dcfdff_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2a0827751c6963e20ef40c7ae2dcfdff_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1856-0-0x0000000074AF2000-0x0000000074AF3000-memory.dmp
memory/1856-1-0x00000000052E0000-0x000000000547C000-memory.dmp
memory/1856-2-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/1856-4-0x0000000005480000-0x0000000005A3A000-memory.dmp
memory/1856-3-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/1856-5-0x0000000005140000-0x00000000052DE000-memory.dmp
memory/1856-6-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/1856-7-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/1856-8-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/1856-9-0x0000000074AF2000-0x0000000074AF3000-memory.dmp
memory/1856-10-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/1856-16-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-78-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-88-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-136-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-235-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/1856-134-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-130-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-128-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-126-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-124-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-122-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-120-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-119-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-116-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-114-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-112-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-110-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-108-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-106-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-104-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-102-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-100-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-98-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-96-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-94-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-92-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-90-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-86-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-84-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-82-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-76-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-74-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-72-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-70-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-63-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-64-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-60-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-58-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-56-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-54-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-50-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-48-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-47-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-40-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-42-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-38-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-34-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-32-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-30-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-26-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-133-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-80-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-69-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-66-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-53-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-44-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-36-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-28-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-12-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-24-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-22-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-20-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-19-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-14-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-11-0x0000000005140000-0x00000000052D5000-memory.dmp
memory/1856-236-0x0000000008E50000-0x0000000009424000-memory.dmp
memory/1856-237-0x0000000008D70000-0x0000000008DFE000-memory.dmp
memory/1856-238-0x0000000009520000-0x00000000099AA000-memory.dmp
memory/1856-239-0x0000000074AE0000-0x000000007529C000-memory.dmp