Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 16:28
General
- Target 2026-11-09_7023a8c54c3fe474f4060ec4fc0d6331_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 3.6MB
- Sample261110-tys7vagg32
- SHA256 1e444d6496a2409f9edf97046922a053db52dcd8db4a8f6bee174829419be141
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_7023a8c54c3fe474f4060ec4fc0d6331_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_7023a8c54c3fe474f4060ec4fc0d6331_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvk1lvnj.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BC7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8BC6.tmp"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES8BC7.tmp
yvk1lvnj.dll
CSC8BC6.tmp
yvk1lvnj.0.cs
yvk1lvnj.cmdline
memory/4324-54-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-39-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-4-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-5-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-6-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-7-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-11-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-22-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-24-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-28-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-8-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-20-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-26-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-19-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-30-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-16-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-40-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-42-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-44-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-48-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-36-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-14-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-12-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-52-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-58-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-62-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-64-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-66-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-72-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-74-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-80-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-32-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-34-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-61-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-79-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-77-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-70-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-68-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-56-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-1-0x0000000074E02000-0x0000000074E04000-memory.dmp
memory/4324-0-0x0000000003070000-0x0000000003080000-memory.dmp
memory/4324-50-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-92-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-86-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-91-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-112-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-125-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-130-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-82-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-84-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-126-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-132-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-129-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-122-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-120-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-118-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-116-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-114-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-110-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-108-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-106-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-105-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-103-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-101-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-98-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-96-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-94-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-47-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-89-0x0000000006F70000-0x00000000073A8000-memory.dmp
memory/4324-658-0x0000000074E02000-0x0000000074E04000-memory.dmp
memory/4324-770-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8113-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8114-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8136-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8129-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8130-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8131-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8132-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8133-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8134-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/4324-8135-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/5276-8120-0x0000000074E00000-0x0000000075421000-memory.dmp
memory/5276-8127-0x0000000074E00000-0x0000000075421000-memory.dmp