Overview

overview

10

Static

static

10

2026-07-06...ar.exe

windows10-2004-x64

9

2026-07-06...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    109s
  • max time network
    33s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_c8bbdda3daafdd0357880305a0ea240b_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 879KB
  • Sample260706-ysgdbagy3n
  • SHA256 86d897f6dc480e1be878b8ea10527bf4d6bc05ec55f0dcf1844b56de70bdc1f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with ASPack 46 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 43 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_c8bbdda3daafdd0357880305a0ea240b_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_c8bbdda3daafdd0357880305a0ea240b_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:5188
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1544
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4484
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3468
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2820
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4560

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Replication Through Removable Media

          1
          T1091

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          3
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Replication Through Removable Media

          1
          T1091

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          patcher.exe
          • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
          • Size 879KB
          • SHA256 86d897f6dc480e1be878b8ea10527bf4d6bc05ec55f0dcf1844b56de70bdc1f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe$
          • Path C:\Program Files\7-Zip\7z.exe$
          • Size 1.4MB
          • SHA256 e72c51dfbf5810e1ad4b773bc77f494d3416d92b27366ba104d831736a050f13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 893KB
          • SHA256 06e59184317bef07383d72e1650f902e5f0fa9a4a7ce56bab205cb5b49e1e0a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InspectorOfficeGadget.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
          • Size 926KB
          • SHA256 6907b51738d34df648156e3d4152d53df189ea5903621c5e531eae07a6facc2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java-rmi.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
          • Size 902KB
          • SHA256 788241a5d5b5670735365ce2a82a5d489494e56c65f346ccb9cbadfe9d70627b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javac.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
          • Size 902KB
          • SHA256 8cbeea03fea0625f1bc06e1e62febe4dbad786d8e608b125ace01a50a7c77110
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javadoc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
          • Size 902KB
          • SHA256 bfb7c3a32669a77cd559c4930d371c070455509b66be910968f99f7091b5a5f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javah.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
          • Size 902KB
          • SHA256 4a144a75b9b92a9cfece0aec2596fc393d6a5f05912238f9dd2dc764bc17bb27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
          • Size 902KB
          • SHA256 91fcdc0d7e0665fed21407768bf6203685bc64690d362c56b85d029d74168cc2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jcmd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
          • Size 902KB
          • SHA256 4e5b8b107a17a6c4899f450d88eab95b4e57025cfc1882c214ca5cbcc20695d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jconsole.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
          • Size 902KB
          • SHA256 ddefef389009538c2e4c77d8e8f143417eeff8fea07f50be5198f378b2670e25
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdb.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
          • Size 902KB
          • SHA256 c7f5e8ad25986420802d22310d98862bbd73ec10d05b2c951723a7b7b60c4489
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdeps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
          • Size 902KB
          • SHA256 98034a4272aec22241c99ffd53a408dec1b6fa0d9021b279ec904deb10eb8966
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jhat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
          • Size 902KB
          • SHA256 eb5d9b66edbd10697d241b91f95ee7e57414a9092eb5383d0012d73c59503e84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jinfo.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
          • Size 902KB
          • SHA256 4a7d56b95867c38bb24f372b4b81b64118e9e8bcbaeb104d5b8d8cc9e985f49a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jjs.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
          • Size 902KB
          • SHA256 520b0a47ad969127b38faa424826954335f4a2924fa409c8ea1556eba02e6f84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jmap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
          • Size 902KB
          • SHA256 36fc59adb6529a356fe4610537d4314464575077d1686cbe93e5b574524b045f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
          • Size 902KB
          • SHA256 5577e3e411661338fefc10a47a52e37caaecfb8dbe15ac939940a4a8a492383a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jrunscript.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
          • Size 902KB
          • SHA256 8ce64d37d16f4eef4d12edb827212dbd40c850a32608706ab2d620eac1607d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jsadebugd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
          • Size 902KB
          • SHA256 b53fd07344efede1ac291d2e2a02298de1a0a1226451d9d086678b528c0a0804
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstack.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
          • Size 902KB
          • SHA256 6bda7c4deb1f6b1009605022281308df2e9c2cc26594e247247837381ceb6c4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
          • Size 902KB
          • SHA256 6d64624c77028b40028ed02ea5e40fb4ccd86c6d22fc63fd5bac20dcd4367c06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstatd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
          • Size 902KB
          • SHA256 c954149b2ac2a7e960faf9a2451dfa3aa851574cbe40ed8eca228e45efd57203
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          keytool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
          • Size 902KB
          • SHA256 bca9a2fff946479f7781490ee44657a2ba5e5b286fc6e1b8a59f695bbf924ef6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kinit.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
          • Size 902KB
          • SHA256 d0e8eae71fb500d342a0ab74ed4ed27ca807be768fa53c79837480b6d67e6b70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          klist.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
          • Size 902KB
          • SHA256 e684ef86d6522039fd5092b9f1fcc40dcde4cb0aeff57ebdea10bc37ea59b5d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ktab.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
          • Size 902KB
          • SHA256 7d2b28881e2c2b9451d8958f42aa97e97af31c0d2032b19cbd3105b01ccd73af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          native2ascii.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
          • Size 902KB
          • SHA256 81af69fd83d074cd5c6e143ffa1bf73db7ddc3875288d35795558e443e5ae1ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          orbd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
          • Size 902KB
          • SHA256 8faa915821d1a6952b382a6d61fb9bf6caa4774f231dca04f238cce80d2d7be0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pack200.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
          • Size 902KB
          • SHA256 f612e182d0c3bac92c9aba285f43297e2b61a139fec974bf82b9e284fbe021e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          policytool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
          • Size 902KB
          • SHA256 8b65b90aa927d124f89b92152144e154785b36e33fa71aaca7a3bf92d9715e5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmic.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
          • Size 902KB
          • SHA256 bc11261681d667766111223e4c4cb6905be3eb9bd82ca32c7436295c78d29b6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmid.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
          • Size 902KB
          • SHA256 283f83a98d8021f7d0fbe29906016dbdbfb5e3fd60c44fdae756e4288b67198f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmiregistry.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
          • Size 902KB
          • SHA256 3313c2e55162d62bdd8f7d5477b9d2d3159f02455bdedd56c14199b0a2acca07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          schemagen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
          • Size 902KB
          • SHA256 c38be61bb1a36425ea6e3b9c787b04a688c7bb6e65612a1ae6e7fa4fe7fe3904
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          serialver.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
          • Size 902KB
          • SHA256 bdcb07c2710c028045a63c359072b3fb64f00693a81a2497965c6d5da1db9ca1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          servertool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
          • Size 902KB
          • SHA256 1c81e78676153dbcbea7de9ef8ea841cf202dce15a3f0bc2682d35386e268f00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tnameserv.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
          • Size 902KB
          • SHA256 434824dc38ccee2c2e702901eb2fe181a64092dbe7cb8d6087540fb7af84614a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsgen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
          • Size 902KB
          • SHA256 868de12c1215404ddfb0e33a71fb483d6db4d36b6c411f15068cfcb86a44e441
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsimport.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
          • Size 902KB
          • SHA256 99ff7378c9939d10fcd4d63e9f884c3c4a75d823c6cc3ec7a9c1ab0b3b9bb7f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
          • Size 902KB
          • SHA256 c5f3b6ddbdaecd1527733eb32781ea5542b1b5ab28ce452dee1f0183ed6f4a80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe$
          • Path C:\Program Files\dotnet\dotnet.exe$
          • Size 1022KB
          • SHA256 b887417e1fe3e7374c390dd51168a4d0e76824755a8b0892bbbd512217b3578a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 607B
          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GroupFormat.exe
          • Path C:\Users\Admin\Desktop\GroupFormat.exe
          • Size 1.1MB
          • SHA256 d11633a602e29a12e32691c219d1488b268719344499f3af9bde57c6a271695a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1544-22-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/2820-544-0x000001E7130F0000-0x000001E7131F0000-memory.dmp
          Download

          memory/2820-538-0x000001E702910000-0x000001E702930000-memory.dmp
          Download

          memory/2820-546-0x000001E702CF0000-0x000001E702D10000-memory.dmp
          Download

          memory/2820-560-0x000001E7133D0000-0x000001E7133F0000-memory.dmp
          Download

          memory/2820-516-0x000001E7001E0000-0x000001E7002E0000-memory.dmp
          Download

          memory/2820-514-0x000001E7001E0000-0x000001E7002E0000-memory.dmp
          Download

          memory/3468-1055-0x0000023EED640000-0x0000023EEDA74000-memory.dmp
          Download

          memory/5188-0-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/5188-15-0x0000000000400000-0x000000000040F000-memory.dmp
          Download