Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 15:00
General
- Target 2026-08-31_c3ffb3ccd02cfeada4ec232387827211_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 296KB
- Sample260831-sc93sshb23
- SHA256 2a380323d828cdcef843bad1b61eb66576be2ccc475ecdbdc9424019c0b6ae2e
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_c3ffb3ccd02cfeada4ec232387827211_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_c3ffb3ccd02cfeada4ec232387827211_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5604-0-0x0000000074352000-0x0000000074353000-memory.dmp
memory/5604-1-0x0000000004BD0000-0x0000000004C24000-memory.dmp
memory/5604-3-0x0000000004C40000-0x00000000051FA000-memory.dmp
memory/5604-2-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-5-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-4-0x0000000005240000-0x0000000005292000-memory.dmp
memory/5604-17-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-29-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-192-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-131-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-129-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-125-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-123-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-121-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-119-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-115-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-113-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-112-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-109-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-107-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-105-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-103-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-101-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-99-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-97-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-91-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-89-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-87-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-85-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-83-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-81-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-77-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-75-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-73-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-71-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-69-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-67-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-65-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-63-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-59-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-57-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-55-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-51-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-49-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-45-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-43-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-41-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-39-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-37-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-33-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-27-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-25-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-23-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-21-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-19-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-11-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-9-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-127-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-117-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-95-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-93-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-79-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-62-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-53-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-47-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-36-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-31-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-15-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-13-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-8-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-6-0x0000000005240000-0x000000000528D000-memory.dmp
memory/5604-1315-0x00000000052C0000-0x0000000005352000-memory.dmp
memory/5604-1316-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-1318-0x00000000053D0000-0x00000000053DC000-memory.dmp
memory/5604-1317-0x0000000005540000-0x0000000005556000-memory.dmp
memory/5604-1319-0x0000000005560000-0x000000000556C000-memory.dmp
memory/5604-1320-0x00000000055E0000-0x00000000055EA000-memory.dmp
memory/5604-1321-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-1322-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-1323-0x0000000074352000-0x0000000074353000-memory.dmp
memory/5604-1324-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-1325-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-1326-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5604-1327-0x0000000074340000-0x0000000074AFC000-memory.dmp