Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 03:30
General
- Target 2026-09-08_ad806dd2897e9a1749301fec391d97d5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 6.0MB
- Sample260910-d2mapsem4w
- SHA256 cc884147d19f761159c563203728501d6946d1f5f10fce6603853f7040b93cf8
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_ad806dd2897e9a1749301fec391d97d5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_ad806dd2897e9a1749301fec391d97d5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2592-0-0x0000000074C82000-0x0000000074C83000-memory.dmp
memory/2592-1-0x0000000006BD0000-0x00000000074FA000-memory.dmp
memory/2592-2-0x0000000074C70000-0x000000007542C000-memory.dmp
memory/2592-4-0x00000000062A0000-0x000000000685A000-memory.dmp
memory/2592-3-0x0000000074C70000-0x000000007542C000-memory.dmp
memory/2592-5-0x0000000074C70000-0x000000007542C000-memory.dmp
memory/2592-6-0x0000000007500000-0x0000000007E28000-memory.dmp
memory/2592-7-0x0000000006860000-0x00000000068FC000-memory.dmp
memory/2592-8-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-9-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-11-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-14-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-15-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-17-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-19-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-21-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-23-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-25-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-27-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-29-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-31-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-33-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-35-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-37-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-39-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-41-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-43-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-45-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-47-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-49-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-51-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-53-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-55-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-57-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-59-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-61-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-63-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-67-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-69-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-71-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-75-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-77-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-81-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-83-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-89-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-91-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-95-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-97-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-101-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-107-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-111-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-115-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-119-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-125-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-131-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-133-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-129-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-127-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-123-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-121-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-117-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-113-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-109-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-105-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-103-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-99-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-93-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-87-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-85-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-79-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-73-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-65-0x0000000007500000-0x0000000007E23000-memory.dmp
memory/2592-1102-0x0000000074C82000-0x0000000074C83000-memory.dmp
memory/2592-1104-0x0000000074C70000-0x000000007542C000-memory.dmp