Overview

overview

7

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

7

2026-08-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_29e094928b1b31b2f922bed65f65634d_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
  • Size 4.3MB
  • Sample260804-pwvknseq6z
  • SHA256 681ce0df56093750423e2a75a6fd2b04b69b31bfa9d422eb656e164c7589ca58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_29e094928b1b31b2f922bed65f65634d_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_29e094928b1b31b2f922bed65f65634d_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\22110.exe
      "C:\Users\Admin\AppData\Local\Temp\22110.exe"
      2⤵
      • Executes dropped EXE
      PID:2364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 6.4MB
        • SHA256 374c982f4da8f7d72b244f006ea839643b24e5c2a7778f69200f5bb57fdadc73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        22110.exe
        • Path C:\Users\Admin\AppData\Local\Temp\22110.exe
        • Size 422KB
        • SHA256 cd54af09cd30ef256056465254cd1cccb5f06d8a77c261731e981415d37c7c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 1KB
        • SHA256 56c0acf2c101babdafd0e698160b39e3391bd767d5f17126722c6571aa562af4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 1KB
        • SHA256 c90c1498991597740c4cee02b6d4ce3dabe010e77a496e653c7debc844aee3dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 1470dc4ef77347dea875dd920be5b2b363f65841c56d665f957f9abff42ff065
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 8d0497d40479785ef1a54ce95db6a182ac9f9cf37b4c5295196807c68dde9f10
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 85b866cadccd5c863705345de03b135affaf3cf567e9252abb0bf821f13f9b35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 07fe7ebfff3d04aa4fe236ca4dbd1db963ee547441423787a26f0c2786318478
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 fc97aceb2d54bd064f71927cb7aa1ca6f395cdc06862bb7308d188a14768f0e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 fae61ab82a37a3fd9a11a3ce91298a2028528236bad9bdb10c8326879e023861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 526B
        • SHA256 c0484730576e84f8c869353bc222cca0bd0f5c8ef57fb0b29d2026f288c84390
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 748B
        • SHA256 6348c0fd32a67393b920add3df4faf54b652e5087f185daeb9cff01e7c725694
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 869B
        • SHA256 106934a2af8c60a7518258dad053fbbac05f19e4b93f9dde2f4752162e3cd060
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 696B
        • SHA256 e49ad1c32c3f25185d6fbca844abdc8b2f310180061665dad9594025d1bc970a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2040-5015-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5017-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-3357-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5013-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5014-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5604-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5016-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-2048-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5152-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5599-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5600-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5601-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5602-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2040-5603-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/2364-9-0x00007FF77C6B1000-0x00007FF77C6B2000-memory.dmp
        Download