e5f89256b3526220d60fbe6f05bcb84657817e915cfc75cae07ecae7bfe6ceaa

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_bb629f30cc1975b019d2d55824975fb9_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 438KB
Sample260705-sdn7qagx5m
SHA256 e5f89256b3526220d60fbe6f05bcb84657817e915cfc75cae07ecae7bfe6ceaa
MD5 bb629f30cc1975b019d2d55824975fb9
SHA1 fe308546c3b3598b891e682bc0d338925fa588f7
SHA512 8a8bcc518812171b7e4824b623edceeb635f024825ce69e66413dc59d1978f48775cad02f1982c68dc986e381776b92325783e071cada8e520e0b8ef0f773e45
SSDEEP 6144:HR9N6vGqdCivtNAH8X48Ft/KUEL3ZDRYy3HHe4RnDb0QecsmBb22NH:x9NEhv3AHXy4D7YQHe4RnDb0QXvJ22
TLSH
T1A794F015B8C080B6D5322D3104E5DAB2AE7C79704F6A9FAF639C477D2F700A063257AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2792	sogou.exe
5304	sogou.exe

Loads dropped DLL 2 IoCs

pid	Process
2792	sogou.exe
5304	sogou.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemServiceAutoRun = "C:\\users\\Admin\\appdata\\local\\SystemService\\sogou.exe"	sogou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemServiceAutoRun = "C:\\users\\Admin\\appdata\\local\\SystemService\\sogou.exe"	sogou.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sogou.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sogou.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_bb629f30cc1975b019d2d55824975fb9_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sogou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sogou.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
2792	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe
5304	sogou.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 2792	5664	2026-07-05_bb629f30cc1975b019d2d55824975fb9_elex_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 2792 wrote to memory of 5268	2792	sogou.exe	89
PID 5268 wrote to memory of 1716	5268	cmd.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-05_bb629f30cc1975b019d2d55824975fb9_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_bb629f30cc1975b019d2d55824975fb9_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664
- C:\users\Admin\appdata\local\systemService\sogou.exe
  "C:\users\Admin\appdata\local\systemService\sogou.exe" STARTFIRSTTIME
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c C:\Windows\system32\SCHTASKS.exe /CREATE /F /TN SystemService /xml C:\users\Admin\appdata\local\SystemService\task_xml_file.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Windows\system32\schtasks.exe
      C:\Windows\system32\SCHTASKS.exe /CREATE /F /TN SystemService /xml C:\users\Admin\appdata\local\SystemService\task_xml_file.txt
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1716

C:\users\Admin\appdata\local\SystemService\sogou.exe
C:\users\Admin\appdata\local\SystemService\sogou.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemService_Log.txt

Path C:\Users\Admin\AppData\Local\systemService\SystemService_Log.txt
Size 573B
SHA256 3b33b9e30964925c16ee6eff0e4b50776c84283f1aae8b1121241534573fd44c
MD5 d0d96ed96614d273189a9be145556cfb
SHA1 6fea853f79d1ae289bb265ea4a18724be90183d0
SHA512 7afb6f77a3a267c5429df34ec44d63b880b5ac268b1fba5f674f4ed33c399da3cf4740d6e9d8c1e3e223135595655f66f9d538b29485d2f937cd9248febbe279
TLSH
T1C4F08B27DAEAEBD10BD2819B3695019C9DB74542BD0A70307478C2A6C6C2C29EDE2CC2
MD5 SHA1 SHA512 TLSH

Submit Download

SystemService_Log.txt

Path C:\Users\Admin\AppData\Local\systemService\SystemService_Log.txt
Size 3KB
SHA256 dfab37cb911379f831c7967214579a5f8ae47d8711210ee82b4a7d97e6e364d8
MD5 401d65716a088a03f577343af989d49c
SHA1 fa36d7ef69fe3618cfbc19e7c8998eadb656852a
SHA512 37285eca27be4609940aa87233e5c267e999e4694cb4583672967ca0a1212e34d9b098c29c3615335b8faabc9912b0597a0caf5936fff02a1d9b87dc14026c07
TLSH
T1DB814BC2008A455665D157A63232A18FCAE5F0B9FA5F74E87B34FEEE10948A4DCF25C3
MD5 SHA1 SHA512 TLSH

Submit Download

SystemService_Log.txt

Path C:\Users\Admin\AppData\Local\systemService\SystemService_Log.txt
Size 5KB
SHA256 6d346c11dd03cdb0f00493c1c0f580b414f88dac4397a6fc0247ca849e464655
MD5 cdcde91ccfc60d2baa589d0549ffc744
SHA1 f19ce5f084dd2e44529ebe33502bd567906826df
SHA512 a68786a4bb74c658ccc92faccddcf07eb136041352d673b915705d23e9966b2d34ba4daa3370a6a64d85bef48227589c323b6ff77272ddf3c79920641a1202b4
SSDEEP 96:rOjzlfLS6+4TsbTyj7nyj7F3yj7vyj7hyj7Cyj7Diyj7iyj7CRyj7CGOyj7CHiyW:rOjzdLS6+4gb+PyPoPaPUP1PDVPVPhPn
TLSH
T1DCB147C3004A456665D157A63232A18F8AE6F0B9F95F74E83B34FEEE10958A4DDF21C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sogou.exe

Path C:\Users\Admin\AppData\Local\systemService\sogou.exe
Size 14KB
SHA256 6c6cf2320164376dbb3da26ecd9174e377b5df69356ca3521158ba6b51546216
MD5 56ef1f05a006f2be53e287df69aee7bf
SHA1 7791fbf07528fd644b73741a7d57347eef575c48
SHA512 71e1fd4ddb296b59cd8c800201bb7091c0a942ae217b5754406fe2870bcc8ac1ef4de710bee6adfd9e07ef754bc103570ea428e6e8302386a57b470d90678819
SSDEEP 192:vO4R2/6Gm/DTrQCDzekt7bSkJqicu8j+lOWeu9BfzzSrZWnGa:vPRRGm/DQ07ws8j+lOWPZ0ZWnGa
TLSH
T19062F6434FA87423EB928F7591F880569D76F6C05FB928DF8022804929217D37BF8729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemService_Log.txt

Path C:\users\Admin\appdata\local\SystemService\SystemService_Log.txt
Size 743B
SHA256 0f7bb555c6cb9e8b228c659e8446ccc31293326b945ea8cdd0620c1ccd339c59
MD5 6e70cbc6370293c770e1a8b94153160c
SHA1 aa1b744948707b887a497d38945156f68df70d53
SHA512 4a41492d68a37d777a78cfd99bea98294db666e350b1268235d4c957b6ce10c9d85a5014283524a391f16d23b0c0023a42dbacc4e708dbabe97d285e4de582a1
TLSH
T1E8016816CEE6DA910AD2929B2194015C5EB74511BC4AB0307478C1FAC28282DD9D2DC1
MD5 SHA1 SHA512 TLSH

Submit Download

SystemService_Log.txt

Path C:\users\Admin\appdata\local\SystemService\SystemService_Log.txt
Size 841B
SHA256 9940a837e1c5120efd1520f9d7a787298375ad260353c161bde59b814e444260
MD5 652133eff956590ce735b85530958f47
SHA1 6ecee0cd581df25b6973cab8436ee8c97ca9259e
SHA512 af4ccc70a45cc42edb5f04ad947ddff629d8e02d789629d121e7088da9df534894a24a3d207bfb734c85b0dbb7bb125bfb84d94a7e583a996b079c9f66a1a76e
TLSH
T14401A61ACAEAEA950AD3929A3295114C5EBB4041BD8EB4307478C1FEC282DADD9D2DD1
MD5 SHA1 SHA512 TLSH

Submit Download

config.dat

Path C:\users\Admin\appdata\local\SystemService\config.dat
Size 64B
SHA256 972cd8fb41ebbd4622cf673fff9497c732a950bc18b63a034d3d6f18fff59f40
MD5 0c99442cd23ab761d931f4bbde1633cf
SHA1 fc4bd7e0e4b61fc056f6f4e4b3ddb61bccb23150
SHA512 0ab9d431da502c7de7607257a1fa818b0f22dd3d3b75f0738e84079d7f1cd54a0cb69011239b16750f1a09cb4347b4fef51f189f0ee49bcaed13b14cd93d7515
MD5 SHA1 SHA512

Submit Download

task_xml_file.txt

Path C:\users\Admin\appdata\local\SystemService\task_xml_file.txt
Size 1KB
SHA256 53687d5e841da5a054970001a8095dfc67ce7674d0408f74759243b24404307f
MD5 f054e8ee6b500ebb77d56f9fe438cb44
SHA1 d4a174d6f96b103448c301674db92666db5fb8c9
SHA512 b558cccb28cdbcc041c53e2dc6e81212de382adeeaac03d7dd3f6e4c2525148a23761dc748037afb0a9f23771f3c1707caf6800f34611128963e2e4f45d22bb5
TLSH
T169311068BC40F71FA5F3423A82B296C29337476147AB4C34D5C84B7F73C529A221247B
MD5 SHA1 SHA512 TLSH

Submit Download

SbieDll.dll

Path C:\users\Admin\appdata\local\systemService\SbieDll.dll
Size 571KB
SHA256 8e5f1345753cfda91e17caaa7683ddf9e2b2a1d4208231e874bc8f64c0579573
MD5 e604a2401601e050aa0c9e5c63e1a651
SHA1 2c1d5920200837c5ce8f79b47a167d7e53466def
SHA512 ccf006c05b46efd6da1bd3902b313da6667164f8edd10abb22b323e8ef3dd67b3561cfcf7ea1e9ca3858831905df1cb13a532cb948026eb3fb614fe128c9a49e
SSDEEP 12288:isZ+nl0gqOG4avM9qTJWcNb5lw5vLaKx:iy+neHlvDTJzNbnorx
TLSH
T1D3C49B21B641C032D8EA31717069EB79636C6E358B5858DFE7C47E6B2DBC2C36231B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download