Overview

overview

4

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

3

2026-08-03...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_4039cb5f066c079c43066e9eda512d89_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
  • Size 4.5MB
  • Sample260804-pgpe4sem3w
  • SHA256 e575cb5c4bdb86c0c996dc0049b9d401586078fd71674c43ae7d927ebea2ee75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4039cb5f066c079c43066e9eda512d89_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_4039cb5f066c079c43066e9eda512d89_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3480

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 6.6MB
        • SHA256 4411003abc5d8f8931e71f4808af6117c1f8e03225f2e5e10481d7d60d590b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        21212.exe
        • Path C:\Users\Admin\AppData\Local\Temp\21212.exe
        • Size 601KB
        • SHA256 3a5921cdfebaafe4d7356685f0fb815da65c65ec3bc93ccf3258e1a2e8c1973c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 947B
        • SHA256 ff436d7943740eacdf7c4b8fedc8a1411b3d4fd6854ea715ad11e4da3df08465
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 1KB
        • SHA256 f953152ceee15929b688dee7f2143331985ecec087925b9f084e3a61b4450ff2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 d7633b3248a1502fdb76f2600f6c85cc747d5360aab2ce62cc3b72f20ea8a31a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 44262a238d33df273cd81b694e82eaa3111fc1d8b11a76f55f0509fe0b62bf4e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 c6863ded8c8d2fde548290ac5ff15cdddf855141729b3f29eff58c7c9f4c74fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 2a677fb65b21002cc3e91e544612c8c9290562399b7b1f5554dc42cb89809c25
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 1a7cde4111803f92d2ea53980c0582950b0b06c931131f645ba9a6e6542e99b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 51ce74056220c936e2460a5c70a46e0b31aa508045ff8054e0aa66369399ffe2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 238B
        • SHA256 591c9bdd51e3f2f475fcb8103c4a64f15263d4086b6b6b5a884c119115e3ec73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 e86e226a7dfa1ee0e43fab58c31159cedf513478c64af9a3ee8e171813f2f5ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 7855f6bbbe8ca4667abb6da6eded1ba0d56eff9c52808e2d00373d2f0d63e241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 3adc398b43c2f21f1903ee58bb9824e4035704fa76051d76bf533be3f194be40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 b55869869938c344da13dbd871cc35e04c69c3f95b92505c930d1e1adcb2851c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 424B
        • SHA256 88864374e84e0f867f59d6e8da861d5d96622b60b9fdd7ce4369fb4e7aa32d4b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 482B
        • SHA256 4ded174b6945b42b80841fa6cd63e6388fd004fa50d92f737f337c1ee3c2c056
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 760B
        • SHA256 c5b5f06f7a52ac427d75053185161effb12d9a15d82a0b338632ac3af5f61698
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3480-226-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-9105-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-224-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-3319-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-5006-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-5746-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-6325-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-225-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-11314-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-11820-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-12073-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-12483-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-12486-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3480-12635-0x0000000000400000-0x000000000040F000-memory.dmp
        Download