a58383501fc524b37c48071766591dfb84ebbaea8e1eec7e4796e901d954730d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_ede334effc45b50b707049e42b5ce27b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 816KB
Sample261023-d7atvshv21
SHA256 a58383501fc524b37c48071766591dfb84ebbaea8e1eec7e4796e901d954730d
MD5 ede334effc45b50b707049e42b5ce27b
SHA1 fb466d25bea147bbb1b9e321246ff0b72387071e
SHA512 4941feb195a008fb63efae36b95569218e869f924a18e95662d5662bbfc57e2e31d2eb6f32aeb1b62dfb182b390fb6a741899ddf5627926144fdcf1519215b18
SSDEEP 6144:NDKW1LgbdlSTBBvjc/2gySTc0kRKh3MmUVx98aCYcW5S:lh1Lk7STnvjcugHQ0kkFCH8ocW5S
TLSH
T1FA05BF207691D3B2C56B453088D5DBB45E3BB822CB2551C777EAFBAE3E313D09226385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	4300	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_ede334effc45b50b707049e42b5ce27b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_ede334effc45b50b707049e42b5ce27b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ede334effc45b50b707049e42b5ce27b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 436
  2⤵
  - Program crash
  PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4300 -ip 4300
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4300-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4300-1-0x0000000000400000-0x00000000004CC000-memory.dmp