Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 20:04
General
- Target 2026-10-01_0ed77f6e823c480acb9d7599787e0934_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 622KB
- Sample261002-ythb1a1y7m
- SHA256 5e503fd726891e220c21de5b28f1240768ec12e0efe32fca4ce2498fcb1ad35c
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_0ed77f6e823c480acb9d7599787e0934_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_0ed77f6e823c480acb9d7599787e0934_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5192-0-0x0000000074F32000-0x0000000074F33000-memory.dmp
memory/5192-1-0x00000000026F0000-0x0000000002784000-memory.dmp
memory/5192-3-0x0000000074F20000-0x00000000756DC000-memory.dmp
memory/5192-2-0x0000000004D80000-0x000000000533A000-memory.dmp
memory/5192-4-0x0000000004C30000-0x0000000004CC2000-memory.dmp
memory/5192-5-0x0000000074F20000-0x00000000756DC000-memory.dmp
memory/5192-6-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-70-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-88-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-86-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-132-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-130-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-440-0x0000000005490000-0x0000000005522000-memory.dmp
memory/5192-118-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-110-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-98-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-96-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-92-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-90-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-46-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-141-0x0000000074F20000-0x00000000756DC000-memory.dmp
memory/5192-44-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-42-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-40-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-128-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-123-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-121-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-116-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-114-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-112-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-108-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-106-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-104-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-102-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-100-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-94-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-84-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-82-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-80-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-78-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-76-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-74-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-72-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-68-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-66-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-64-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-62-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-60-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-58-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-56-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-54-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-52-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-50-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-48-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-38-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-35-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-33-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-31-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-27-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-25-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-24-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-19-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-17-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-15-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-37-0x0000000074F20000-0x00000000756DC000-memory.dmp
memory/5192-125-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-126-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-29-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-21-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-13-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-11-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-9-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-7-0x0000000004C30000-0x0000000004CBD000-memory.dmp
memory/5192-441-0x0000000074F20000-0x00000000756DC000-memory.dmp