snojan | 58eeb52dc3bc7a4ed60e3b0cf5684c57b831b210c302456070bb31807adb620d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_b80a651bc10fb55146ac5353d566c2ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 420KB
Sample261102-mtp63avt9p
SHA256 58eeb52dc3bc7a4ed60e3b0cf5684c57b831b210c302456070bb31807adb620d
MD5 b80a651bc10fb55146ac5353d566c2ee
SHA1 c28eb23c921a7128890119db76f55fe878307628
SHA512 f9275929e169d7f95a528f1584675b213cf1b5c4129bb075fa9a14d010dbce06bad5982879056d9514b540014001d1bfa6dadf93fe3a7f128465f51daa67146d
SSDEEP 12288:2De3jgR19CZ5Lh1Lk70TnvjcsMxdABSnLHOr26:qe3UjQZ53k70Trc18BSnLW26
TLSH
T12394CF20B580D0F3E8A3017105859B769E31F835076AC5C7F7D9AFBAAD6039197683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_b80a651bc10fb55146ac5353d566c2ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_b80a651bc10fb55146ac5353d566c2ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_b80a651bc10fb55146ac5353d566c2ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-01_b80a651bc10fb55146ac5353d566c2ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b80a651bc10fb55146ac5353d566c2ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-SlcG6nKSJJqcExj3.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-SlcG6nKSJJqcExj3.exe
Size 420KB
SHA256 4d3c8749b87b94ce2f42e807610f4eae085dfe6eea180f5df452dcfa5c10b07d
MD5 629069f3660979e9bae12b4c805dcdca
SHA1 18e1f64df7ce1ac6a443aa6c34957b9d4979c745
SHA512 d0e14f21f327c195590a83b3af2865523c6b3c741b3e08a317d3e3f3cb7ee275f7f52b2a21fc50e5649cafaa043b5efaeb0e31acf5ec4ba4a49beca4aa9e9438
SSDEEP 12288:2De3jgR19CQ5Lh1Lk70TnvjcsMxdABSnLHOr26:qe3UjQQ53k70Trc18BSnLW26
TLSH
T11894CF20B580D0F3E8A3017105859B769E31F835076AC5C7F7D9AFBAAD6039197683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download