Analysis
- max time kernel
122s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 15:03
General
- Target 2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 2.0MB
- Sample261002-se3fqssdrf
- SHA256 9fbabdbbda7653cb66b7884f114611da19a02eadf6876682f9ea3944a80fd1b8
Malware Config
Signatures
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 6 IoCs
- Detects executables packed with SmartAssembly 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- SmartAssembly .NET packer 8 IoCs
Detects SmartAssembly .NET packer.
- Drops file in Windows directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 5 /tr "'C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe"C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe"1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c14419ab-8236-4f31-8888-5cb984e7d9e6.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exeC:\Windows\Speech_OneCore\Engines\WaaSMedicAgent.exe3⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0943109-1355-4991-ad56-433b8cee822c.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\PolicyDefinitions\dllhost.exe"C:\Windows\PolicyDefinitions\dllhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Visual Basic
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
2026-10-01_4dcca55b802d90f506d8b5b2397dc8f5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.log
WaaSMedicAgent.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
RCX6420.tmp
__PSScriptPolicyTest_x4jdl1xb.v1s.ps1
b0943109-1355-4991-ad56-433b8cee822c.vbs
c14419ab-8236-4f31-8888-5cb984e7d9e6.vbs
RCX6634.tmp
WaaSMedicAgent.exe
memory/3792-20994-0x0000000008180000-0x00000000087FA000-memory.dmp
memory/3792-20647-0x0000000006C30000-0x0000000006C62000-memory.dmp
memory/3792-20726-0x0000000007770000-0x000000000778E000-memory.dmp
memory/3792-20727-0x0000000007790000-0x0000000007833000-memory.dmp
memory/3792-20648-0x0000000071040000-0x000000007108C000-memory.dmp
memory/3792-15212-0x0000000005750000-0x000000000576E000-memory.dmp
memory/3792-15315-0x0000000006CD0000-0x0000000006D1C000-memory.dmp
memory/3792-20996-0x0000000007B40000-0x0000000007B5A000-memory.dmp
memory/3792-7998-0x00000000059E0000-0x0000000005A02000-memory.dmp
memory/3792-21012-0x0000000007BD0000-0x0000000007BDA000-memory.dmp
memory/3792-21013-0x0000000007DE0000-0x0000000007E76000-memory.dmp
memory/3792-21017-0x0000000007EA0000-0x0000000007EBA000-memory.dmp
memory/4204-94-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-5235-0x0000000007980000-0x0000000007992000-memory.dmp
memory/4204-118-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-116-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-114-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-112-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-111-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-104-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-100-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-96-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-106-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-98-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-0-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-80-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-78-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-76-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-74-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-72-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-70-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-68-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-82-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-62-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-60-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-66-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-58-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-54-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-52-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-46-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-44-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-40-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-48-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-42-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-38-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-36-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-34-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-32-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-30-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-29-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-26-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-22-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-20-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-10-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-8-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-1322-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-6-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-16-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-5-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-14-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-1468-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-1657-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-5228-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-5229-0x0000000002B60000-0x0000000002B7C000-memory.dmp
memory/4204-5230-0x0000000002B90000-0x0000000002BE0000-memory.dmp
memory/4204-5232-0x00000000063C0000-0x00000000063D0000-memory.dmp
memory/4204-5231-0x0000000002BF0000-0x0000000002BF8000-memory.dmp
memory/4204-5233-0x0000000006400000-0x0000000006416000-memory.dmp
memory/4204-5234-0x0000000007830000-0x0000000007838000-memory.dmp
memory/4204-120-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-5236-0x0000000007840000-0x0000000007848000-memory.dmp
memory/4204-5237-0x00000000078A0000-0x00000000078B0000-memory.dmp
memory/4204-5238-0x0000000007970000-0x000000000797A000-memory.dmp
memory/4204-5239-0x00000000078D0000-0x0000000007962000-memory.dmp
memory/4204-5241-0x0000000007B10000-0x0000000007B1C000-memory.dmp
memory/4204-5240-0x00000000078C0000-0x00000000078C8000-memory.dmp
memory/4204-5242-0x0000000007AE0000-0x0000000007AE8000-memory.dmp
memory/4204-5244-0x0000000007AF0000-0x0000000007B02000-memory.dmp
memory/4204-5245-0x0000000007CB0000-0x00000000081DC000-memory.dmp
memory/4204-5246-0x0000000008220000-0x000000000822C000-memory.dmp
memory/4204-5247-0x0000000008240000-0x000000000824C000-memory.dmp
memory/4204-5248-0x0000000008250000-0x000000000825C000-memory.dmp
memory/4204-5249-0x0000000008270000-0x000000000827C000-memory.dmp
memory/4204-5250-0x0000000008520000-0x0000000008528000-memory.dmp
memory/4204-5252-0x0000000008770000-0x000000000877E000-memory.dmp
memory/4204-5256-0x0000000008560000-0x000000000856C000-memory.dmp
memory/4204-5254-0x0000000008540000-0x0000000008548000-memory.dmp
memory/4204-5253-0x0000000008530000-0x0000000008538000-memory.dmp
memory/4204-5259-0x00000000085A0000-0x0000000008606000-memory.dmp
memory/4204-5260-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-5251-0x0000000008280000-0x000000000828A000-memory.dmp
memory/4204-5255-0x0000000008550000-0x000000000855A000-memory.dmp
memory/4204-124-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-126-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-128-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-1-0x00000000053B0000-0x0000000005668000-memory.dmp
memory/4204-2-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-6800-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-7369-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4204-130-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-122-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-3-0x0000000005670000-0x0000000005C14000-memory.dmp
memory/4204-4-0x0000000005C20000-0x0000000005ED6000-memory.dmp
memory/4204-108-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-102-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-86-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-88-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-90-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-92-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-84-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-64-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-56-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-12-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-18-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-50-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4204-24-0x0000000005C20000-0x0000000005ED1000-memory.dmp
memory/4600-21018-0x0000000007940000-0x0000000007948000-memory.dmp
memory/4600-20995-0x0000000071040000-0x000000007108C000-memory.dmp
memory/4600-8103-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/4600-6183-0x0000000005320000-0x0000000005948000-memory.dmp
memory/4872-21014-0x00000000073A0000-0x00000000073B1000-memory.dmp
memory/4872-21015-0x00000000073D0000-0x00000000073DE000-memory.dmp
memory/4872-21016-0x00000000073E0000-0x00000000073F4000-memory.dmp
memory/4872-21004-0x0000000071040000-0x000000007108C000-memory.dmp
memory/4872-8283-0x0000000005810000-0x0000000005B64000-memory.dmp
memory/4872-6071-0x0000000002810000-0x0000000002846000-memory.dmp