cf52631d2251409269bb6c10181f155c6e3d0a1ca2a73426b21b5f7a49170a00

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_9eba2c5f00e292af327531fce8b65acb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.1MB
Sample261101-155b1sdd83
SHA256 cf52631d2251409269bb6c10181f155c6e3d0a1ca2a73426b21b5f7a49170a00
MD5 9eba2c5f00e292af327531fce8b65acb
SHA1 004b218f3ee6c7312c0533823a7ae9184ab3afe9
SHA512 65d7b4a429d55ca7c9f4add509f309c4a4a102ff1bbf85e900bbe88f5ecdc1b637892956a3ddb32e7f934c0ca21368571b9d2f957e9275b47837ab913540f5bd
SSDEEP 24576:qe3UjQe53k70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOq:qeHexkQTAKYS/v6h3+1uhZcT2NnvOq
TLSH
T16B350120B584D4F3E86301714484CB71AE32E875076AC9C7F7D9AFB5AE6039197683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_9eba2c5f00e292af327531fce8b65acb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_9eba2c5f00e292af327531fce8b65acb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_9eba2c5f00e292af327531fce8b65acb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9eba2c5f00e292af327531fce8b65acb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9eba2c5f00e292af327531fce8b65acb_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-iCqT3EXqzcLAWBco.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-iCqT3EXqzcLAWBco.exe
Size 1.1MB
SHA256 14e3a853fd74f7eba636a31f49b41d765fca4478ff12a8b9604a0e036a1fea2b
MD5 0510a58a8e889d5229b2ffc845943007
SHA1 0fd93dd901d8669166bb1d465a7919834323b526
SHA512 ab4b76fef9c5595eb7cdbb4c58df08787b741efd24cf54fe0b5a1a46349d9ecbaba6fd5ab07fdc17856bd6a48d525b14ae733dd9a031e6ebf6f893714a879291
SSDEEP 24576:qe3UjQm53k70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOq:qeHmxkQTAKYS/v6h3+1uhZcT2NnvOq
TLSH
T122350120B584D4F3E86301714484CB71AE32E875076AC9C7F7D9AFB5AE6039197683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads