Overview

overview

10

Static

static

10

2026-07-05...ar.exe

windows10-2004-x64

9

2026-07-05...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_83330fd9568988086a0596f1393ac991_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 909KB
  • Sample260705-bttnpsf141
  • SHA256 c62f6c190b45955b851ff6f471a44f607cec2c5f7e37dcbe0603f9d065e3cdd1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Custom signature
    Detects executables packed with ASPack 55 IoCs
  • ASPack v2.12-2.42 52 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 47 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_83330fd9568988086a0596f1393ac991_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_83330fd9568988086a0596f1393ac991_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:716
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 909KB
        • SHA256 c62f6c190b45955b851ff6f471a44f607cec2c5f7e37dcbe0603f9d065e3cdd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32Info.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
        • Size 938KB
        • SHA256 c63f3abed904ebee7d6bf9966317777eba2ff4b570394cc982cea5cfa7402a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroTextExtractor.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
        • Size 956KB
        • SHA256 1e9d7bfde1774503d9bdd4e12fbf600e116aa0e1013c1ffa4f8117bc0eb9dbd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        reader_sl.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
        • Size 962KB
        • SHA256 36896c05cdc02cc28bb513976fbd3e891e244cfe2cd816ec1153782c21c3d389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 4c350106dd2142f684829010e09a55e17331a8a8d87faa7e907cb7c1946be87c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 924KB
        • SHA256 2982ac6b1f51f7bfb8fcca0014c57a859d9ecbc9d55343f5d8f3ed17b6a6f4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 957KB
        • SHA256 07a187a91efd88d03f31003aa8861ef0b47ef2f5b800a5585354a0af5aefb21c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 933KB
        • SHA256 404b611204438f727d1ab4e85d11985515d0e7023180fd081b5d3d171a8bf306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 933KB
        • SHA256 8b689f8544a78a5c652b646a0fdf365a369aa9449d5091aec41199e157e24080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 933KB
        • SHA256 419c91eaa07475379a89e7043ca2a7a9d378fc7fb1e446ef0cfc62521d2bf3ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 933KB
        • SHA256 b02ef44f26c9c894eded0df0e4733fe889d2aae8bb2834c0ae6802ad1a8d179f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 933KB
        • SHA256 be32284a6d6da7d1a30f4692a19d1afc2f246b8f3f2c63c44bf780c3e8b5500f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 933KB
        • SHA256 8a1d4689c147e80e0da88c6555f0ce706e4914d7e9d37262c8231781c0b75e3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 933KB
        • SHA256 8a893b29342607dcd4d4dfe0bddcfae3b6bc6bc272d4d31d3891952de357a7a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 933KB
        • SHA256 2a9d3a1abd976e0072e33868d6928ddf1b249045abfe659a81b126a3d5255795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 933KB
        • SHA256 7ffa7ec0010929ea1c62fb5b4a2d71c526b4cb0187b5164ef8b63431a6a79e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 933KB
        • SHA256 a02e48e1ad532b86aece037abfdb23e92d08c8fb3df9d22817ea615ac47148bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 933KB
        • SHA256 7b823618522a078f26c92e4ebdd974a35591f099a6b618cc40bb235690df4610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 933KB
        • SHA256 2aff773250c3d96f595f1d4da0c42ad78f688c3ee7370f28cbedef35449f7dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 933KB
        • SHA256 9542b71a81fb88d0a41c72565cac7257f7ed52e1561ea8a5cdb1edb3baca1dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 933KB
        • SHA256 2a8a9f50de60f64f8d2cf01649fe5df6f76ccfc7b40368e30d2ff8b4981957fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 933KB
        • SHA256 78effffd91b69b401c4caa9ea6157e4fe9c4384bf58850967c743ff5348f620e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 933KB
        • SHA256 f6a7d97b24dd12b02c219273874a1ffb2e9c75d9a8655f63937cdd17297fc0f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 933KB
        • SHA256 8135e26c3018370deda98817ea952a4c01fdfcd0f6cfba61f13b4c16d08d1781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 933KB
        • SHA256 00c65c28139b8b1f6f5bc22e4aca82eaca4b9c0169597349cfa7861ce7c523aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 933KB
        • SHA256 f8d2326c595eb0212dffb3b8c44a3a852d1883d1da2d15985bdb899712715ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 933KB
        • SHA256 442518f9721ebeb06ffaac22cd5752b05a817d54218bdccab4624ea979f8c2e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 933KB
        • SHA256 4603aeaac6b0eea78cf9ec15fd3fbad268534f56f7f71b98c05a07268b3d2864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 933KB
        • SHA256 d3ea63089e39f11b1696d1cb964554bce9069567b4321e9ba7f2ef6aed101707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 933KB
        • SHA256 e6e5a4b2077471ae4cc42d25d80a2a6d490635e20fb2a8d7ed032356a28d641d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 933KB
        • SHA256 6d2345add8a6bb566749e403ac9c978677bdb1f4c3e7fa6264bec509a60f9b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 933KB
        • SHA256 1748b8b42c85efa29df926fe7db57ae4fafebf758cc7fc367af68d6b8a4a9801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 933KB
        • SHA256 5820645a51b9984d90fe496122a01128a5961e832eba75e2172a4c6894628edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 933KB
        • SHA256 5b32af87f10f9c737cec7a9b66fb8efa856f8ed2c94923480d48a4a97d914b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 933KB
        • SHA256 f1697b291657ea421d29f3eb5306882142f071d195a2cd0e9df979321e58c761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 933KB
        • SHA256 db799eb7ff547aeeaf8647a9ea946bb47184b2a88f96d7474f1b478843d64c35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 933KB
        • SHA256 5b6c26434cb9f86bea6a63be341a2a04baa3c032a39cf949059a9dfee2bbb3a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 933KB
        • SHA256 d78e81ef58e71f95458c8ce83193d06a2f525781a2db669f835f607fc290822a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 933KB
        • SHA256 5ecaf7d2d7262aef818e7dc263d6a71a6ba7dea9cd6f72eaa608ddcd4531c0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 933KB
        • SHA256 31b176d77a2dbf1755dfcccb983720b2d63702a7aa0cfcb52edd624239bab981
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 933KB
        • SHA256 12c34d08aad605db23a1c43f010b4721b933ca41533f911e006a4bac95663665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 933KB
        • SHA256 2c59a3da886e70090f94cc90c8e718b23739b55a6ce57dca110f227c64966382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 933KB
        • SHA256 4550bc238443e51cb0da4be6d907d5345895d093894f549054a8b1112fb787d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 933KB
        • SHA256 e81e5f209c900b61a15a1eebd5ce04e35c0a677f1e33b9cd2edcf3e5e0fe26e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 933KB
        • SHA256 6593ad78383a77ed4ddd36cf7876fc4edc59e8c8df549582fabec0146f8f83d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 933KB
        • SHA256 dcd0ec12cb8679d7c6279d6828fb9905be7223e3c1937ebca26f88787a54bee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SELFCERT.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
        • Size 943KB
        • SHA256 3fd3a5712981e9ece4e71c2003db5dfc5b639887fd160a040fa6f9944d48772e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 953KB
        • SHA256 7ae5fa36c1c385ff66535af8cd029c9521f98776f41f0b2bc3d2072fe3e09557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoev.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
        • Size 966KB
        • SHA256 f7b447c7607ee104ed6480a9e06cefab537a2cfb32839157f7ace4fbeaa36bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msotd.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
        • Size 966KB
        • SHA256 68f8e70f0bcbe66a2ad9c665d0a1050e6d63a5c56e3d78d30a39e5ccb619190c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msouc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
        • Size 965KB
        • SHA256 294ba744fa140e787cfc6b2b59ef46b7594281e06fc33028e70641d468311a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmadminicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
        • Size 971KB
        • SHA256 9711974efb9bf7d6334b74e284520cc66936e02742627b0770ec1ce76f0a84e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/716-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/716-59-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/5976-73-0x0000000000400000-0x000000000040F000-memory.dmp
        Download