Overview

overview

7

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

7

2026-08-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 12:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_29e094928b1b31b2f922bed65f65634d_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
  • Size 4.3MB
  • Sample260804-pwvknseq6z
  • SHA256 681ce0df56093750423e2a75a6fd2b04b69b31bfa9d422eb656e164c7589ca58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_29e094928b1b31b2f922bed65f65634d_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_29e094928b1b31b2f922bed65f65634d_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\22110.exe
      "C:\Users\Admin\AppData\Local\Temp\22110.exe"
      2⤵
      • Executes dropped EXE
      PID:752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.3MB
        • SHA256 54c9b3e887a4bd77a1b156269991630fe6c14d2ed2bb9e04ae6343a754b0c18f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        22110.exe
        • Path C:\Users\Admin\AppData\Local\Temp\22110.exe
        • Size 422KB
        • SHA256 cd54af09cd30ef256056465254cd1cccb5f06d8a77c261731e981415d37c7c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 947B
        • SHA256 ff436d7943740eacdf7c4b8fedc8a1411b3d4fd6854ea715ad11e4da3df08465
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 90071d11398faefad42fc0376706c36498fef4d9d7e235022126dbdbf9cf3b2c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 bbd80327cfc4a8b1949b5acada344c5a0e468a00add8d1257744858857c247f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 413636fc70b8f5d59b77b90ce811fef3f11b1d7028275b34625e24cce11662d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 2b7333ae8cc34119e89ab7a7c2679998a67969196ba575581b0782c30614a71f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 40a6e78f832511f8ab3956169afdab46dde87c8f122771513e88ced42d9b34a8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 aa943bdafc8cc7ea97d7e30fa53eb2003e297af9e08498d7d41671403785d72e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 408B
        • SHA256 c95625c6df6dbfc2397665037e01b810f9c80b5107a364dc3332bc1a201c36e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 760B
        • SHA256 c5b5f06f7a52ac427d75053185161effb12d9a15d82a0b338632ac3af5f61698
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/752-13-0x00007FF61DC71000-0x00007FF61DC72000-memory.dmp
        Download

        memory/4388-11527-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12590-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-3478-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-5774-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-7277-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-2080-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12586-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-2102-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12591-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12592-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12593-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12594-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12595-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4388-12596-0x0000000000400000-0x000000000040F000-memory.dmp
        Download