Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 00:28
General
- Target 2026-10-28_8707bd284a999680ed7956805f13eea1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 683KB
- Sample261030-asmckavv5k
- SHA256 0ca49b6744676b9905f1e9df3bd1f5347744054d9e2707c3a23b597fca6bd8e7
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_8707bd284a999680ed7956805f13eea1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_8707bd284a999680ed7956805f13eea1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8qww7OJ.exe"C:\Users\Admin\AppData\Local\Temp\a8qww7OJ.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_8707bd284a999680ed7956805f13eea1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exeC:\Users\Admin\AppData\Local\Temp\2026-10-28_8707bd284a999680ed7956805f13eea1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8qww7OJ.exe"C:\Users\Admin\AppData\Local\Temp\a8qww7OJ.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CLRHosting.dll
CLRRuntime.dll
EleCrypt.dll
NAudio.dll
System.Data.SQLite.dll
_base.dat
_core.dat
_main.dat
a8qww7OJ.exe
a8qww7OJ.exe
d01.zip
d02.zip
d10.zip
d50.zip
haidebtn.dll
msvcr100.dll
°Æ.mp3
°Û.mp3
µã.mp3
·¡.mp3
¾Á.mp3
Áã.mp3
½.mp3
Æâ.mp3
Ǫ.mp3
Èþ.mp3
Ê°.mp3
ÊÕ¿î.mp3
ËÁ.mp3
Íò.mp3
΢ÐÅÊÕ¿î.mp3
Îé.mp3
Ò¼.mp3
Ôª.mp3
ÔÆÉÁ¸¶ÊÕ¿î.mp3
Ö§¸¶±¦ÊÕ¿î.mp3
wolfssl.dll
memory/2956-10981-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/2956-6649-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/2956-6490-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/2956-6479-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-74-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-114-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-86-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-84-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-82-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-80-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-77-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-73-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-70-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-68-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-67-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-65-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-62-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-59-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-56-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-53-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-51-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-46-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-43-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-39-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-36-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-32-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-28-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-25-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-19-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-13-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-14-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-10-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-8-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-7-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-2734-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-2733-0x0000000074C12000-0x0000000074C13000-memory.dmp
memory/4548-6473-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-90-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-17-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-20-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-22-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-1-0x0000000004E90000-0x0000000004F92000-memory.dmp
memory/4548-2-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-3-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-4-0x0000000004F90000-0x000000000554A000-memory.dmp
memory/4548-10302-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-34-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-6-0x0000000004D80000-0x0000000004E80000-memory.dmp
memory/4548-5-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/4548-40-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-30-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-26-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-147-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-44-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-48-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-54-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-61-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-0-0x0000000074C12000-0x0000000074C13000-memory.dmp
memory/4548-78-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-92-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-101-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-96-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-95-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-98-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-102-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-105-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-108-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-111-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-88-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-117-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-119-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-123-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-129-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-133-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-135-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-139-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-141-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-145-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/4548-126-0x0000000004D80000-0x0000000004E7B000-memory.dmp
memory/5328-17876-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/5328-15474-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/5328-13859-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/5328-8181-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/5328-8341-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/5328-8168-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/5328-8143-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/6712-21945-0x0000000006330000-0x000000000685C000-memory.dmp
memory/6712-21944-0x0000000005490000-0x0000000005652000-memory.dmp
memory/6712-22183-0x0000000009300000-0x0000000009392000-memory.dmp