Overview

overview

10

Static

static

10

2026-07-09...ar.exe

windows10-2004-x64

9

2026-07-09...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    100s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_1c5d841355eb023b90c3b6a81a0bf4c5_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
  • Size 897KB
  • Sample260709-sdxh4acw2p
  • SHA256 6907fc9785cee4feaba4ece3a9b80d7e659f9f371b1ebb035e7432d0718b7722
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwareaspackv2discoverypersistencespyware

Malware Config

Signatures

  • Detects executables packed with ASPack 42 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ASPack v2.12-2.42 39 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 46 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_1c5d841355eb023b90c3b6a81a0bf4c5_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_1c5d841355eb023b90c3b6a81a0bf4c5_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:1676
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4744
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies registry class
      PID:972
  • C:\Windows\system32\userinit.exe
    C:\Windows\system32\userinit.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4092
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
    1⤵
      PID:4268
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2040
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4452
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3084

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            patcher.exe
            • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
            • Size 897KB
            • SHA256 6907fc9785cee4feaba4ece3a9b80d7e659f9f371b1ebb035e7432d0718b7722
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe$
            • Path C:\Program Files\7-Zip\7z.exe$
            • Size 1.4MB
            • SHA256 4bb2f69654b97e0caab0f0b09f25d7bdd1c480868dd92073b50b822f4b8f7f45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 911KB
            • SHA256 f4206f4b10466ab1fb4aa49e138e5f675d46aa02fc23ab2239325372834f9bc0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InspectorOfficeGadget.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
            • Size 945KB
            • SHA256 2d59fe57d516b81ac4118a44e0f7c61418ee4407b8728014fb2c2c1d966abbdd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 920KB
            • SHA256 23a30ea6e77c5809a9c21f532e2fc114fba283059b2631bf9c74baf42a5b32cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jconsole.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
            • Size 920KB
            • SHA256 98ffc47a6a4abf9030088602e3ee0f2d289820260534e77ca14e53835a5270c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jdb.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
            • Size 920KB
            • SHA256 04c4658deeef38d6fdad036129d96a6d70bcdb4582a40c6cd8c25e7de354c2b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jdeps.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
            • Size 920KB
            • SHA256 2fa7c3834d0441dd52abf3f4bdb7bb9a4fb9ea766d81056ad60e69e1480eea01
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jhat.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
            • Size 920KB
            • SHA256 0279ecc491e5be15e80320138c0a40da663119f88614d679a67b9508c74d26ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jinfo.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
            • Size 920KB
            • SHA256 dc84b6747d188dc10b5d60fc080bf1faad86156f9cb7e660fa2e2b41c64d8a65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jjs.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
            • Size 920KB
            • SHA256 afde8e63da90b83163c2f56b3c3b89f1a5327541b84e31e44bc6a9feb77a5e23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jmap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
            • Size 920KB
            • SHA256 354053f91d36535d06056a9235c14f1cf20408995b048c0e46a9fdb2d37b7317
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jps.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
            • Size 920KB
            • SHA256 a5d10611211b816dc55f3c4465e5f94dd33b7756a5938732fd45d78704d1e575
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jrunscript.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
            • Size 920KB
            • SHA256 f8016f67973f808ad82db51b32ddfd432d4e58b375002f2440f56047b85554a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jsadebugd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
            • Size 920KB
            • SHA256 79d6779e5567a5a681f080c0bfdb34bae115e72a7a278a11c56ba385c56ea244
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jstack.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
            • Size 920KB
            • SHA256 1fc1dcdd3986a408979182cd3ad5be9f5cffdf8fb87e26f11e1726e657dddeba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jstat.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
            • Size 920KB
            • SHA256 5187ebca1da3325e2677fc746b6e8968f0b02c7a8091d6c0bbf9994ae7150b10
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jstatd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
            • Size 920KB
            • SHA256 6e7acc97357b247419c48198fe11c28bb5f040538c952a1db94c4d32b2c41be9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            keytool.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
            • Size 920KB
            • SHA256 f6dbf4ec6c4149cd853bf21f6e50dd951083b33604a4d4f45a336fa2df684b8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kinit.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
            • Size 920KB
            • SHA256 e462a4558709efe62fe06d88e8e0cb4ea04484d85b432c8130aebe138e1f304f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            klist.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
            • Size 920KB
            • SHA256 02e2475289e56cce7f5a10afe6c99e39ff182016435f017dbe8127224a3c9915
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ktab.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
            • Size 920KB
            • SHA256 5e3bb07dda26a8e15b928f2ab2c41d3127a22b970a16d191660e846c2c9a9187
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            native2ascii.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
            • Size 920KB
            • SHA256 4ba01030d31a99b2a1556388bb31da3239115f41f033d3e9e043c94f3603a88b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orbd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
            • Size 920KB
            • SHA256 32309bdf5a17d554b75683ddafb712445d7d7ff69641d4f54dcb32de202feb78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pack200.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
            • Size 920KB
            • SHA256 2e73c17f7303bf76f95fba7a7ec1126b885c9fea14c724939a1d731f6ec96a73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            policytool.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
            • Size 920KB
            • SHA256 73268c27a9378a395fd4ee6e3d762448b891f76c60235fb648baa7d14f1f4553
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmic.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
            • Size 920KB
            • SHA256 2a849dd5a8c9ab713385e68977a5cdb47d3c95f34ccd00b39bdb609c8cc3be23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmid.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
            • Size 920KB
            • SHA256 fb6df33e8993535e7d0def9f874f964eee9774b929f189a22fb778ed88c9fad5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmiregistry.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
            • Size 920KB
            • SHA256 494be1b67a9946dce4c8e7f0d96a8c67adda7ce897a797e0787675562aaeba3b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            schemagen.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
            • Size 920KB
            • SHA256 8aeb9761073f088119ba26d0079245223a90e7175a15a4d8261915e1afe3df94
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            serialver.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
            • Size 920KB
            • SHA256 6cbf31efd0bf1a109a704e778a86a468c5f6a9ff57407f0ab09fe93f6b8f81bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            servertool.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
            • Size 920KB
            • SHA256 9fc55cb794ddcce3501d6190312eeaaf96b6c0f428c2873e88c2eb6f044be46d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tnameserv.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
            • Size 920KB
            • SHA256 289740b8473a2b4a97859ad874d6b4b21a70fd40d5605dbd8ad70727bc9133ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wsgen.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
            • Size 920KB
            • SHA256 b5bc92efaeeea38cbc86c2287b26d15cdc49731594ede9d388a2b83d9c25fd9f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wsimport.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
            • Size 920KB
            • SHA256 9bdad31a7eefff692f43b100a7678c815ac901769c39b687ef62d5b8762a1676
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            xjc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
            • Size 920KB
            • SHA256 6eb5b59e033adc53c5ed1a306eb2090ae991c1f8c520c184d5f9a019c7514b8f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SDXHelperBgt.exe
            • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
            • Size 930KB
            • SHA256 2aecaa2cc56bf7312c369102987283306879e33692ab17185160a79d17f98475
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SETLANG.EXE
            • Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
            • Size 973KB
            • SHA256 e8b5c94948f2ab3b84447433d1c455ccece17293cf5bcbd0940092ec45274ebd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Wordconv.exe
            • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
            • Size 941KB
            • SHA256 6b66208469a2285dddf66ca7e82de6967a9d913fd2965c4ae97ba58ad9020ba2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1676-0-0x0000000000400000-0x000000000040D000-memory.dmp
            Download

            memory/1676-21-0x0000000000400000-0x000000000040D000-memory.dmp
            Download

            memory/4092-772-0x000000000CFA0000-0x000000000DE1D000-memory.dmp
            Download

            memory/4452-580-0x0000018D9DB00000-0x0000018D9DB20000-memory.dmp
            Download

            memory/4452-549-0x0000018D8D050000-0x0000018D8D070000-memory.dmp
            Download

            memory/4452-543-0x0000018D8AE10000-0x0000018D8AE30000-memory.dmp
            Download

            memory/4452-536-0x00000185801E0000-0x00000185802E0000-memory.dmp
            Download

            memory/4452-544-0x0000018D9D230000-0x0000018D9D330000-memory.dmp
            Download

            memory/4452-538-0x00000185801E0000-0x00000185802E0000-memory.dmp
            Download

            memory/4744-22-0x0000000000400000-0x000000000040D000-memory.dmp
            Download