snojan | 3725dfbafda3d2d2532a4545e96afa6b4dfe6fa6436bb5ad94e51d8ffc4c9687

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_4b891a94f1861d618982894e6e252ffa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 292KB
Sample261017-wpm1ksty7p
SHA256 3725dfbafda3d2d2532a4545e96afa6b4dfe6fa6436bb5ad94e51d8ffc4c9687
MD5 4b891a94f1861d618982894e6e252ffa
SHA1 c757acf68d3b035d32d47df155ef9217d812be14
SHA512 756791c7b14b5779c13f67bce8c2ea8ca8b81dbcfb7ac1c6437c97593e511d1f0ff468637982f42635cd65796fb9d1e36bd1e5f3493156cdad595d4a06d23501
SSDEEP 6144:2DeM7iNEkgiOb31k1ECDJjPDKW1Lgbdl0TBBvjc/YVM6w:2De3jgR19CD5Lh1Lk70TnvjcsM5
TLSH
T154548D20B580D0F3E8B3007145859B755E35E835076AC6C3F7D9AFBA6E60391A7683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_4b891a94f1861d618982894e6e252ffa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_4b891a94f1861d618982894e6e252ffa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_4b891a94f1861d618982894e6e252ffa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-16_4b891a94f1861d618982894e6e252ffa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_4b891a94f1861d618982894e6e252ffa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-mZZGmRDQyOXEtQF7.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-mZZGmRDQyOXEtQF7.exe
Size 292KB
SHA256 34076f9d1c63ae65f2213bb3722f2631c93252bfe38764c676942dc6a86deabf
MD5 d7990ff4543f40207b46f7152a50a94d
SHA1 9079e1a9e9e804ded067554f96a9c3aff6192310
SHA512 13e609767ebc315958aa73dbcc9872d9011834ce389cd9de1ac7c6ede673d8da225ed38e32aece0fd23060362ebe6dddbd7270726ea5e085ba5b2435965d1e03
SSDEEP 6144:2DeM7iNEkgiOb31k1ECPJjPDKW1Lgbdl0TBBvjc/YVM6w:2De3jgR19CP5Lh1Lk70TnvjcsM5
TLSH
T1EA548D20B580D0F3E8B3007145859B755E35E835076AC6C3F7D9AFBA6E60391A7683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download