Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 09:53
General
- Target 2026-10-28_14aa9a26099ead3558648db8bbfb588e_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 683KB
- Sample261030-lwmchsys6j
- SHA256 13074da1621be6d12c0f9919cfc4c71bc23222876416358b52295a463fb39102
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_14aa9a26099ead3558648db8bbfb588e_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_14aa9a26099ead3558648db8bbfb588e_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\p8BR5VVb.exe"C:\Users\Admin\AppData\Local\Temp\p8BR5VVb.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_14aa9a26099ead3558648db8bbfb588e_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exeC:\Users\Admin\AppData\Local\Temp\2026-10-28_14aa9a26099ead3558648db8bbfb588e_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\p8BR5VVb.exe"C:\Users\Admin\AppData\Local\Temp\p8BR5VVb.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CLRHosting.dll
CLRRuntime.dll
EleCrypt.dll
NAudio.dll
System.Data.SQLite.dll
_base.dat
_core.dat
_main.dat
d01.zip
d02.zip
d10.zip
d50.zip
haidebtn.dll
msvcr100.dll
p8BR5VVb.exe
p8BR5VVb.exe
°Æ.mp3
°Û.mp3
µã.mp3
·¡.mp3
¾Á.mp3
Áã.mp3
½.mp3
Æâ.mp3
Ǫ.mp3
Èþ.mp3
Ê°.mp3
ÊÕ¿î.mp3
ËÁ.mp3
Íò.mp3
΢ÐÅÊÕ¿î.mp3
Îé.mp3
Ò¼.mp3
Ôª.mp3
ÔÆÉÁ¸¶ÊÕ¿î.mp3
Ö§¸¶±¦ÊÕ¿î.mp3
wolfssl.dll
memory/828-131-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-171-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/828-106-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-102-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-99-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-96-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-92-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-88-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-84-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-81-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-79-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-77-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-74-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-68-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-64-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-62-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-58-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-56-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-52-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-48-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-45-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-42-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-38-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-34-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-32-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-28-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-25-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-19-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-17-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-21-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-15-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-13-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-10-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-7-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-2983-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/828-2982-0x0000000074F82000-0x0000000074F83000-memory.dmp
memory/828-6475-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/828-114-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-1-0x0000000004EF0000-0x0000000004FF2000-memory.dmp
memory/828-3-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/828-2-0x0000000004FF0000-0x00000000055AA000-memory.dmp
memory/828-4-0x0000000004D70000-0x0000000004E70000-memory.dmp
memory/828-5-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/828-6-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-11-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-10717-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/828-168-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-138-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-133-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-118-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-125-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-76-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-59-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-122-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-124-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-127-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-130-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-0-0x0000000074F82000-0x0000000074F83000-memory.dmp
memory/828-136-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-139-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-143-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-145-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-149-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-153-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-156-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-160-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-166-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-110-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-23-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-29-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-35-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-39-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-43-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-49-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/828-53-0x0000000004D70000-0x0000000004E6B000-memory.dmp
memory/1356-21881-0x0000000005820000-0x00000000059E2000-memory.dmp
memory/1356-22120-0x00000000092D0000-0x0000000009362000-memory.dmp
memory/1356-21882-0x0000000006380000-0x00000000068AC000-memory.dmp
memory/3156-6742-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/3156-6479-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/3156-11208-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/3156-6480-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/3156-6654-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/5856-15411-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/5856-8219-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/5856-8237-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/5856-8555-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/5856-14848-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/5856-17807-0x0000000074F70000-0x000000007572C000-memory.dmp