snojan | 89351aafc24f9ce2d5264aea3b1b4e592f9d94e04c51aac8666fd88e1259c320

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_122c9bc7b55775e81cead4e6e22bafde_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 269KB
Sample261109-p5dcract3n
SHA256 89351aafc24f9ce2d5264aea3b1b4e592f9d94e04c51aac8666fd88e1259c320
MD5 122c9bc7b55775e81cead4e6e22bafde
SHA1 46b5b7990f653b5760427bffbc33c1cfcb0eb8ac
SHA512 bf87cdf14b733ce98534e7aaf296aaa3b45434b90382a9bdc0aabb07aedbf4dfa8981e24cf327ae72a71d94c0ce3591636e0d1dd0cde08dd4d297803a7d28f38
SSDEEP 6144:2DeM7iNEkgiOb31k1ECkJjPDKW1Lgbdl0TBBvjc/Q:2De3jgR19Ck5Lh1Lk70Tnvjco
TLSH
T18C448D20B580D0F3D8B301B145849B755E35E835072ACAC3F3D9AFB96E60391A7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_122c9bc7b55775e81cead4e6e22bafde_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_122c9bc7b55775e81cead4e6e22bafde_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_122c9bc7b55775e81cead4e6e22bafde_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-07_122c9bc7b55775e81cead4e6e22bafde_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_122c9bc7b55775e81cead4e6e22bafde_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-ml8NtSnFUvdSZ8Wz.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-ml8NtSnFUvdSZ8Wz.exe
Size 269KB
SHA256 dacf3f5bd8911d36a6fa264154a69b3437a858a2e767f18ccc3810070fddabdc
MD5 66cbd3d9c0852f69794388ad0a94a763
SHA1 9de7e8060f986b8df98f2cd399ae5616859e0ee3
SHA512 285a168c2d85a524ac0eaf18777bb8638403a071ad9f9a2918eef5e3797fdda4acc5623f9566a4b9c1deab76d8725b53598b8e756b6982e6679dc49980dea8b1
SSDEEP 6144:2DeM7iNEkgiOb31k1ECOJjPDKW1Lgbdl0TBBvjc/Q:2De3jgR19CO5Lh1Lk70Tnvjco
TLSH
T14E448D20B580D0F3D8B301B145849B755E35E835072ACAC3F3D9AFB96E60391A7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download