Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/09/2026, 17:22
General
- Target 2026-09-15_6ec024c0979bac0804d980c49b106ee2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 175KB
- Sample260915-vxnfmsck5z
- SHA256 ed119ea0672ceca49e9ac3181b835ed220c85b4bd531589cb80503ad9f4a1ecc
Malware Config
Signatures
- Family: Healer
Healer an antivirus disabler dropper.
- Detects Healer an antivirus disabler dropper 17 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Modifies Windows Defender notification settings 3 TTPs 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 17 IoCs
- Windows security modification 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-15_6ec024c0979bac0804d980c49b106ee2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-15_6ec024c0979bac0804d980c49b106ee2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/108-0-0x0000000074C12000-0x0000000074C13000-memory.dmp
memory/108-1-0x0000000002170000-0x000000000218A000-memory.dmp
memory/108-3-0x0000000004BE0000-0x000000000519A000-memory.dmp
memory/108-2-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/108-4-0x00000000023A0000-0x00000000023B8000-memory.dmp
memory/108-5-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/108-33-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-31-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-29-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-27-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-34-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/108-25-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-23-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-21-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-19-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-17-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-15-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-13-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-11-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-9-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-7-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-6-0x00000000023A0000-0x00000000023B2000-memory.dmp
memory/108-35-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/108-36-0x0000000074C00000-0x00000000753BC000-memory.dmp