snojan | 498005dbaa99578e75b8f4e25686682f55849c0afe289602dd9923cc6d0574c0

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 275KB
Sample261022-1l4alsbf37
SHA256 498005dbaa99578e75b8f4e25686682f55849c0afe289602dd9923cc6d0574c0
MD5 7253da23ae95253724dbe411c88957be
SHA1 7a38f444c43049b2b1b0e9eecb4bef9bfe7ff05a
SHA512 11a0ad907bd109704d838c71dfb569356f25770cdcb0ace099d6bccb07bf7713b39e6db0674061bf74ecfcd167a85a3b35c2dfe605eb62b15fea25f6c95044f9
SSDEEP 6144:2DeM7iNEkgiOb31k1ECnJjPDKW1Lgbdl0TBBvjc/YVMt:2De3jgR19Cn5Lh1Lk70TnvjcsMt
TLSH
T162548D20B580D0F3D8B301B145859B755E35E835072AC6C3F3D9AFBA6E60391A7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-rl5Cr9UTQyLZrifu.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-rl5Cr9UTQyLZrifu.exe
Size 275KB
SHA256 5e5e5ce5ea8754f89c3bd6f376239842dec997575cae46b7f0f3adff3ccdd7e1
MD5 33792130a44f0e5481488ff0ae71bb32
SHA1 6803ca6ca70b95dd7d1588b912f051420babb8ce
SHA512 0cd3ecd20b8d604b2a13248a388639fb0346f64fc21871a75fb54546a5224f1230ee0592b9fd1725b6e2602de5ff5b26a7f55d7b8540edcf69fe7c55d453669b
SSDEEP 6144:2DeM7iNEkgiOb31k1ECaJjPDKW1Lgbdl0TBBvjc/YVMt:2De3jgR19Ca5Lh1Lk70TnvjcsMt
TLSH
T10A548D20B580D0F3D8B301B145859B755E35E835072AC6C3F3D9AFBA6E60391A7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download