snojan | 2b84f310de8b2b037ca50ba69e42f0bbc0c48420c14b775cae554a036332ac71

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_8d314fe3889d70b4adebd4fca742de75_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 255KB
Sample261105-zyex4sdx2w
SHA256 2b84f310de8b2b037ca50ba69e42f0bbc0c48420c14b775cae554a036332ac71
MD5 8d314fe3889d70b4adebd4fca742de75
SHA1 f09c4d11d226f8b8130326013adfb9dea2ac1209
SHA512 3c6571688433255c4efec1460342f29e9ee7cf7ef064bdb290c12e261808af14509c878751880bc03098e394c96aa343aab61442c8e29115315ed5bfb3fdc30c
SSDEEP 6144:2DeM7iNEkgiOb31k1ECoJjPDKW1Lgbdl0TBBvjd:2De3jgR19Co5Lh1Lk70Tnvjd
TLSH
T1DC448D20A580D0F3E8B300B141959B75AE35EC35132ADAC7E3D5AFB56D60391E7683EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-04_8d314fe3889d70b4adebd4fca742de75_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-04_8d314fe3889d70b4adebd4fca742de75_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_8d314fe3889d70b4adebd4fca742de75_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-04_8d314fe3889d70b4adebd4fca742de75_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_8d314fe3889d70b4adebd4fca742de75_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-3IWEvYmTiaFUcnsM.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-3IWEvYmTiaFUcnsM.exe
Size 255KB
SHA256 b6d0305531226229f6a6bea84d0158e06d5ea50fca29e2a7afa9638a926c1d11
MD5 7c1eb831a53f87c2c258354d9bedb991
SHA1 72c0a15fd87dfb33d84a5f67f59973241bf8fcda
SHA512 27cbb3802fa24724f27427ea8e19ba51f129b201db1f0a6470dbda7a7ce6b869e76c86b7401e2cfa4b8a3efe6574d2fe702202b5506a1fd155c3bad56d4ae0c2
SSDEEP 6144:2DeM7iNEkgiOb31k1ECjJjPDKW1Lgbdl0TBBvjd:2De3jgR19Cj5Lh1Lk70Tnvjd
TLSH
T186448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download