Overview

overview

7

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

7

2026-08-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 10:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_8b89585aeb3d1a87be2aecd3caf9a155_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
  • Size 4.1MB
  • Sample260804-m1fafayblh
  • SHA256 6779a8f91d058d7ebce97461949a416556503456bc6118a1c5daddb22e6bd857
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_8b89585aeb3d1a87be2aecd3caf9a155_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_8b89585aeb3d1a87be2aecd3caf9a155_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Users\Admin\AppData\Local\Temp\40121.exe
      "C:\Users\Admin\AppData\Local\Temp\40121.exe"
      2⤵
      • Executes dropped EXE
      PID:752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.0MB
        • SHA256 95f703bda871df4fe0b2e09adf1ca7e2bf4723e74ff9716bf450c6333fdd658b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        40121.exe
        • Path C:\Users\Admin\AppData\Local\Temp\40121.exe
        • Size 199KB
        • SHA256 1487b285ba7282a6d7caf805a402538912f75a003f1415cf3004f9c44175ac62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 947B
        • SHA256 ff436d7943740eacdf7c4b8fedc8a1411b3d4fd6854ea715ad11e4da3df08465
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 1KB
        • SHA256 c1bea011bb6d03e1abf7e658b33535aec49078afc0c86869d931b4830289a7e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 6bc65c602f0ba3aec2699914bb2212c46c41c69f7a29e31b3201bbfd9e147f0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 1231982fe0db95b42b8dda843a3984a2bc9255d4b1ee2801c6480a75762c0ea7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 44bcd3d743aefd9f33f0cc0c2f06c4e88d34b2baee04b9152423e1e9bd68bc6e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 086eee61c0981a72130c8f63194084154b34c24506a7e3ab382302534475f4cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 85231eef0cd028f4f7165c907199ccef7bf54e47ed7e82877b759900ab1e7d48
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 aa30db9ba4e16c984ba9f44a5b7726993b72cffb591fe6d92c62d93f21df3873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 408B
        • SHA256 c95625c6df6dbfc2397665037e01b810f9c80b5107a364dc3332bc1a201c36e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 748B
        • SHA256 6348c0fd32a67393b920add3df4faf54b652e5087f185daeb9cff01e7c725694
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3680-245-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-253-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-248-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-249-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-250-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-251-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-252-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-247-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-254-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-246-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-244-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-243-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-2106-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3680-3513-0x0000000000400000-0x000000000040F000-memory.dmp
        Download