Overview

overview

10

Static

static

10

2026-06-25...ar.exe

windows10-2004-x64

9

2026-06-25...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    127s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 19:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-25_c5b0c5d668a6da3fc43bc8da2cab7f8d_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 862KB
  • Sample260629-ypbcwsd191
  • SHA256 c29997b9fa0aedc3b0551e44749ca6c89be0af330a482c2e46c2554c018ea3a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Custom signature
    Detects executables packed with ASPack 54 IoCs
  • ASPack v2.12-2.42 51 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-25_c5b0c5d668a6da3fc43bc8da2cab7f8d_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-25_c5b0c5d668a6da3fc43bc8da2cab7f8d_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3136
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 862KB
        • SHA256 c29997b9fa0aedc3b0551e44749ca6c89be0af330a482c2e46c2554c018ea3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateOnDemand.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
        • Size 961KB
        • SHA256 e9a35fd551fd48379ee2f569f2dbe946791163b8c2e082382f16be84fdb962e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 9304bad5ba534900e001132886ed75bd12c42f3fe64cafa099ad57f8f93c5ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 877KB
        • SHA256 bce6d3ce53fb6adbc9d42f9fb043aa7717b59fe0a98044c7a4cb3230b672e46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 910KB
        • SHA256 1aa70fda100268a255b579ace67593ba85177c10daa7c0981f8a0b6a10a781ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 1006KB
        • SHA256 80411a7318ff80c26dad99bf4b550b4d26ec80e6cec04385a7776f8b0dc26f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 886KB
        • SHA256 c491a1b29ea1ba34ff1e13713f180e26f7f26fa4142e2a8eae861a0ad6f0fd67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 886KB
        • SHA256 66b08beea704a6437e4f57ec349ec074998981279bd0408093aaeb2d6fb14766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 906KB
        • SHA256 eeb1ed38691d42eb5b747666b3e426f086a30a7f37e49850cf35749ee139fdea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 886KB
        • SHA256 6892343fdb9cc1764029b3af035318ab87b1fb707f2bf398b4a7df283660ca05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 886KB
        • SHA256 bf2dae01f3aa72651e47efbc42575a8c8f01d7b73f26d3fc547939a67a0da70a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 886KB
        • SHA256 de9bbe202d009f9d59d4bb73416cc75e84b086cc07414ed9f6829fea1b1a2ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 886KB
        • SHA256 08d9179a0722d3395f8e9dd71ffcd4c743795e44ecf852f5f70fa4d6a58567db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 886KB
        • SHA256 9586126316c22716803d0618b7ada903355d0e323bd64fad1fa0ca59a4ea360a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 886KB
        • SHA256 54c4a822240d7eeef6a5548845aea1a231638335b28bfd8b739f8e61d4f1c8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 886KB
        • SHA256 1562f48ec1faede86884859313e0f5cbb3b4065456e7a32572b9f2cf854dd408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 886KB
        • SHA256 7dfb581555d0f52985aea90769b6da1f1c7ba6cf5a7a42138f6a533770dc2f4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 886KB
        • SHA256 08ba03cc3d17a90d4a6f82ac1c2007b2a4ea0eed06a15d40e52922803465ffbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 886KB
        • SHA256 ae40f4bd5cea26c7aa70b530f7a8a5477e294fb1b10e4e7df87b6633be68e7d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 886KB
        • SHA256 2109560fa6cd9769c6058c18cc63f3121b4134c6155959013306cd59a95ba4b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 886KB
        • SHA256 3f9fcd2c33dc441e10280ba9b116de812de62be28eeb4ad8dd4235387729f410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 886KB
        • SHA256 7023e11dc675c6367fd7cb069daace48f2a1b6593c45530d726d739ee0b64f38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 886KB
        • SHA256 3226d58c820e841c3b1ed3b5b3357457646396915c5489396507a431c44726cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 886KB
        • SHA256 c2c42f060d0efb5d6ac02fe34b8894c33825180acad74e2ad7f35f1d560ea8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 886KB
        • SHA256 d09c6ef2f15ce131d7ef3cf27e7599c877882916d20d03f3de8631177f16b6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 886KB
        • SHA256 48d1d277336059bf4052c977e362edeb11c8be0724d950ffb25411ed9d5c7dd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 886KB
        • SHA256 08362493e91778f1f1eab3a6698f7fef38b0b7605a622c55c0d057edec3f1200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 886KB
        • SHA256 fb629ddefc57fa0da00a94e15b5e8a2bd322723ad6f09397191c06f473768bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 886KB
        • SHA256 6fa09e4eff422fb5c45a48642cb1417ae44d8723d9aa5824da1ab1ba2fde596c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 886KB
        • SHA256 c5fce1b16127c368aa97b65190298af815f7c010cf8958de73b6f737e1355063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 886KB
        • SHA256 2ce812c48b3b73c6c6caa142f007089e5ca15510b72d406d5885b391b54e2c4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 886KB
        • SHA256 3aea6c58eae018aec047818876c7af20b48fa8725aaeb2ff929c23dd561a3b16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 886KB
        • SHA256 9412984f9472b7ff20f841a81d342d29ff2677249e63aa872430f8f22345199d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 886KB
        • SHA256 b19a70be336c9ceb73cddfee958a296f1760b2ce9ba203822573a3f37aacc5b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 886KB
        • SHA256 d8d3ef8f179716accdae5b535b89f04fe32fdbc602288093c36c655ef9e67a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 886KB
        • SHA256 134f625dfcf6a3c3fc66af114adf96880772c02600a3ac6ee8cd2c93583dbf3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 886KB
        • SHA256 6be0be11721af2dcd9c67a44eb33105e45ff450923728834c374e9ceaa3f3c07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 886KB
        • SHA256 8af1cc2057bb75da3da74c87a1adfbbd00c2129484b4c74ab93a34986025daad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 886KB
        • SHA256 16da3d4045069d04de8bc5ebaa2744b9bee825941389f5cdb9562d0c6671b306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 886KB
        • SHA256 5fd0af57b89aae90817f15a9cf2c4d8c8647c7df02f5870f989d776682cf024c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 886KB
        • SHA256 7ea89104f3aa385330ab4a4a21fbc0972eed1ecd10521dc3ab5b776509572159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 886KB
        • SHA256 1e6255a5dd295ab09b35ac48d8ac87ac044b73b68e507a5f81f11eb966b982c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 886KB
        • SHA256 936a7f1cb98cc36bf06741b998095e161e47e2b30d39b26e83746f3915ac53cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 886KB
        • SHA256 2f3b1d8701a9e4a03eb34ea8fe62001f7b0a25c09ccfc7fe0cb05fbf073f1439
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 886KB
        • SHA256 baeebd3f2ab8f9318018b93838c0d72546a59745eedc3927daf853c9a9f50f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 886KB
        • SHA256 f84fa4d7ead8b7010c9322aa0e81b42671cdcf2103d915490f9ee56ee5cd0728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 886KB
        • SHA256 8074190c63d2f005d9a75c05cbdb57d03b1bf5fc51e676d3ce749c2b9c323008
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 886KB
        • SHA256 c988b99aabb50ff8bc5fbe11f4ea9ff4d2cb44fcaf8c0edb814d754583463a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msouc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
        • Size 917KB
        • SHA256 4ce44bf8976970b5434d7e2403c5eaefdeea852c44afdd092b0eb297d3dd125f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmadminicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
        • Size 923KB
        • SHA256 b1c7af40cc5498a4532107f5da16b60bfe61ffcb85508c8886f974b247e01945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sscicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
        • Size 941KB
        • SHA256 6c54a343813bf7dade40f74b35c43fb9578fac5fc7e63639b08198c0a1c7b8cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3136-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3136-21-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4788-41-0x0000000000400000-0x000000000040F000-memory.dmp
        Download