snojan | 5a499217fe403fcfe75f163c3e78192dd597bb619d59c5635f2d2ce3b525b79f

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 255KB
Sample261018-fpndca115j
SHA256 5a499217fe403fcfe75f163c3e78192dd597bb619d59c5635f2d2ce3b525b79f
MD5 d337a1655d6f09f62ed4ad522ffaa717
SHA1 e10c6adbe650b2bab9055d830d75362b9f09254e
SHA512 e9115404a0c4e53f4b475759284bb70732ca2f7765166bcc3784d31db337b5bd551c391da36836e244dfc6d878f9682e9f814224ed1b2054b0f66bff970314d2
SSDEEP 6144:2DeM7iNEkgiOb31k1EC8JjPDKW1Lgbdl0TBBvjo:2De3jgR19C85Lh1Lk70Tnvjo
TLSH
T126448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-Zdkj56nV39H6bPIj.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-Zdkj56nV39H6bPIj.exe
Size 255KB
SHA256 08d5729ddf5d816cde1f23572ec050ec4a17f1e31f0f1fb3be9102e18d259493
MD5 3c9ad7c8ccdbac10e9326eeb58a950d4
SHA1 2d3dec77b4c3575c40680ab65671349a331e4770
SHA512 974baa9f081ca320165ff1a36bec169c7bf47ed7c8112045c2f8fd0dd87b83f2fcc07480301d91d57019d01e3446ec151aa419a1baa3469abb9ff120ed2f2317
SSDEEP 6144:2DeM7iNEkgiOb31k1ECTJjPDKW1Lgbdl0TBBvjo:2De3jgR19CT5Lh1Lk70Tnvjo
TLSH
T102448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download