Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 12:19
General
- Target 2026-11-01_a932c922625cc608b59763b22197909a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 971KB
- Sample261102-phlevafa54
- SHA256 28dd42986dd9e522ac8bacb2c0c8887ad89bf18552cdf8a8b2674adf65450995
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_a932c922625cc608b59763b22197909a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a932c922625cc608b59763b22197909a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5688-0-0x0000000074742000-0x0000000074743000-memory.dmp
memory/5688-1-0x0000000004F40000-0x000000000506C000-memory.dmp
memory/5688-3-0x0000000005070000-0x000000000562A000-memory.dmp
memory/5688-2-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-4-0x0000000004E10000-0x0000000004F3C000-memory.dmp
memory/5688-5-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-6-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-85-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-119-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-130-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-185-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-182-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-181-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-178-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-176-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-174-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-172-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-170-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-168-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-166-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-164-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-163-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-160-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-158-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-156-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-154-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-152-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-150-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-148-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-146-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-144-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-143-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-142-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-140-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-138-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-136-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-134-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-132-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-128-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-126-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-124-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-122-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-120-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-116-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-115-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-22-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-20-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-112-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-111-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-18-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-108-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-106-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-16-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-14-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-102-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-96-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-94-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-12-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-10-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-92-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-8-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-7-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-188-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-186-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-104-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-100-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-98-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-90-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-88-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-60-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-58-0x0000000004E10000-0x0000000004F35000-memory.dmp
memory/5688-2828-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-2819-0x0000000074742000-0x0000000074743000-memory.dmp
memory/5688-5371-0x0000000005630000-0x00000000056CC000-memory.dmp
memory/5688-5372-0x00000000056D0000-0x0000000005762000-memory.dmp
memory/5688-5373-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-5374-0x00000000061D0000-0x00000000061DA000-memory.dmp
memory/5688-5375-0x00000000061E0000-0x0000000006236000-memory.dmp
memory/5688-5376-0x0000000007760000-0x00000000078A2000-memory.dmp
memory/5688-5379-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-5378-0x000000000B2F0000-0x000000000B3A2000-memory.dmp
memory/5688-5380-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-5381-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-5382-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5688-5383-0x0000000074730000-0x0000000074EEC000-memory.dmp