Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 05:39
General
- Target 2026-10-16_d7be30740731d5a785f61e88b0d17c70_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 643KB
- Sample261017-gcd5ksh18r
- SHA256 52e8b79057a8ebe340884d4fea9cd308041aaf21d504baf94b492ff081d75f5b
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_d7be30740731d5a785f61e88b0d17c70_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_d7be30740731d5a785f61e88b0d17c70_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vVQ4rl1a.exe"C:\Users\Admin\AppData\Local\Temp\vVQ4rl1a.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_d7be30740731d5a785f61e88b0d17c70_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exeC:\Users\Admin\AppData\Local\Temp\2026-10-16_d7be30740731d5a785f61e88b0d17c70_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vVQ4rl1a.exe"C:\Users\Admin\AppData\Local\Temp\vVQ4rl1a.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CLRHosting.dll
CLRRuntime.dll
EleCrypt.dll
NAudio.dll
System.Data.SQLite.dll
_base.dat
_core.dat
_main.dat
d01.zip
d02.zip
d10.zip
d50.zip
haidebtn.dll
msvcr100.dll
vVQ4rl1a.exe
vVQ4rl1a.exe
°Æ.mp3
°Û.mp3
µã.mp3
·¡.mp3
¾Á.mp3
Áã.mp3
½.mp3
Æâ.mp3
Ǫ.mp3
Èþ.mp3
Ê°.mp3
ÊÕ¿î.mp3
ËÁ.mp3
Íò.mp3
΢ÐÅÊÕ¿î.mp3
Îé.mp3
Ò¼.mp3
Ôª.mp3
ÔÆÉÁ¸¶ÊÕ¿î.mp3
Ö§¸¶±¦ÊÕ¿î.mp3
wolfssl.dll
memory/1132-53-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-79-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-106-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-102-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-6-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-99-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-94-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-92-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-89-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-85-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-88-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-68-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-59-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-56-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-51-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-49-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-45-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-43-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-41-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-39-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-37-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-35-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-33-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-32-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-30-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-28-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-25-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-21-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-19-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-17-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-15-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-13-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-11-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-7-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-3483-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1132-6472-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1132-110-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-1-0x0000000004F30000-0x0000000005032000-memory.dmp
memory/1132-2-0x0000000005030000-0x00000000055EA000-memory.dmp
memory/1132-3-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1132-5-0x0000000004D90000-0x0000000004E90000-memory.dmp
memory/1132-4-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1132-117-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-119-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-132-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-130-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-10243-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1132-129-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-127-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-111-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-124-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-122-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-115-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-113-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-9-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-23-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-47-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-0-0x0000000074C02000-0x0000000074C03000-memory.dmp
memory/1132-57-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-62-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-63-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-69-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-65-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-71-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-73-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-75-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-77-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-107-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-81-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-83-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-121-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1132-95-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-97-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1132-103-0x0000000004D90000-0x0000000004E8B000-memory.dmp
memory/1292-6691-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1292-6478-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1292-6479-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1292-9547-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1292-6480-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/1932-21790-0x0000000005810000-0x00000000059D2000-memory.dmp
memory/1932-22029-0x000000000A500000-0x000000000A592000-memory.dmp
memory/1932-21791-0x0000000006470000-0x000000000699C000-memory.dmp
memory/3024-8443-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3024-8062-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3024-8080-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3024-8199-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3024-13398-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3024-15320-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/3024-18285-0x0000000074BF0000-0x00000000753AC000-memory.dmp