snojan | 10cc88b0343ee88c439271c11ca6e8ef142aa58468cc6b870a80b6c161760f8f

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_49e2fcfe6f4f2ffc3be69a8c63507b7f_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 255KB
Sample261027-wxt4vse19s
SHA256 10cc88b0343ee88c439271c11ca6e8ef142aa58468cc6b870a80b6c161760f8f
MD5 49e2fcfe6f4f2ffc3be69a8c63507b7f
SHA1 f5ce907fe34b8288b16da28596a9140dcf892c46
SHA512 d32f4ebbafb47805e5a37b8ad3ab0717af2795fa94fa0be88f6b65750b9528865f68bdfd26dca099083f7951983858c5bf1f6f71b3774cc5e82dbcc2fe4c4255
SSDEEP 6144:2DeM7iNEkgiOb31k1ECqJjPDKW1Lgbdl0TBBvjo:2De3jgR19Cq5Lh1Lk70Tnvjo
TLSH
T117448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_49e2fcfe6f4f2ffc3be69a8c63507b7f_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_49e2fcfe6f4f2ffc3be69a8c63507b7f_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_49e2fcfe6f4f2ffc3be69a8c63507b7f_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-26_49e2fcfe6f4f2ffc3be69a8c63507b7f_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_49e2fcfe6f4f2ffc3be69a8c63507b7f_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-PfrR3Xn9rRWM4tZN.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-PfrR3Xn9rRWM4tZN.exe
Size 255KB
SHA256 6a30c88eb1f9406183b575224b16e312c9da3a7348fcc6f095b6ebd341caf4b0
MD5 1a2d7c0adc7b184746a5d54c0592d00b
SHA1 7ecc24d503002f5c2312ef9d60b59ec89a127ad9
SHA512 c454b246b548a1c6e6263202cc436358ff53c573e4826a7ffbbcdbf69a71dc136a2b04eb30d35510527768bd0d4b4363ecfde510e4b0f3ece0ded766951140eb
SSDEEP 6144:2DeM7iNEkgiOb31k1ECqJjPDKW1Lgbdl0TBBvjo:2De3jgR19Cq5Lh1Lk70Tnvjo
TLSH
T1C5448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download