Analysis
- max time kernel
100s - max time network
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 20:21
Behavioral task
behavioral1
Sample
2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
- Size 2.1MB
- Sample260712-y45v2sat5t
- SHA256 3af8af59ce2fb0fdac9e0bd14fc65ae29d0746465f9fac6e111024d5c3713108
- MD5 f63f49cf3cb254659cbb8c669858e8b9
- SHA1 305edca8538da6cbfffca47ed92ad79d8aab7626
- SHA512 ad976babb91205d6cdc8c9a5afb6d58fa41b29cbe2aa8bca1e909e25522898a71c3abb59c1da20623544903205bdcf1e090c76a66838d16f5f53a6719d27ccdb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaDaEz9vD5TvinrmGZe0p4Ek4niOM:A3k03kHRJq56rbeW4SkZP4sz9MblI1H
- TLSH T14EA54B16F6B84B62D07BC075C5D6AA66FA323C455F3087CB03459B283F277D19A3932A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2080-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4a0-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2080-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4160-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bac3-220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001acac-1265.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4a0-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-222.dat aspack_v212_v242 behavioral2/files/0x000300000001bac3-220.dat aspack_v212_v242 behavioral2/files/0x000400000001acac-1265.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4160 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2080 2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe 4160 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_f63f49cf3cb254659cbb8c669858e8b9_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2080
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 3af8af59ce2fb0fdac9e0bd14fc65ae29d0746465f9fac6e111024d5c3713108
- MD5 f63f49cf3cb254659cbb8c669858e8b9
- SHA1 305edca8538da6cbfffca47ed92ad79d8aab7626
- SHA512 ad976babb91205d6cdc8c9a5afb6d58fa41b29cbe2aa8bca1e909e25522898a71c3abb59c1da20623544903205bdcf1e090c76a66838d16f5f53a6719d27ccdb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaDaEz9vD5TvinrmGZe0p4Ek4niOM:A3k03kHRJq56rbeW4SkZP4sz9MblI1H
- TLSH T14EA54B16F6B84B62D07BC075C5D6AA66FA323C455F3087CB03459B283F277D19A3932A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 ceb1e5f9368c9f409e9d04c6a53f639adf60657cd275ecad28ae9241cd9de006
- MD5 8880cca5c9c9079f7010fdfc7b9067ae
- SHA1 178a7f1daf3dfb54fc6a33ce0e5fc4f1f9309059
- SHA512 9f03d2f196593dc0c3feb8d3a25ebc5f8b321e5c80ef35cba1daf1c8997cf0e2bbe32bad55e70a951b54ba94a56b47d4dab3e71822cb7caa7dba585964500c0b
- SSDEEP 49152:A3k03kHRJq56rbeW4SkZP4sz9MblI1DPji0Aj:A3k03kHRNr7fkZclI1bjo
- TLSH T1FFD54B16F6784762D077C079C5D6A69AFA3238461F308BCB0345DB283F277D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 2.1MB
- SHA256 34a1a0c71b1f099e950d009d12e2432ff2f9f7443afa5d673e513cff0a675bcb
- MD5 33e94a7c3a244384ca7ea9f03c36c072
- SHA1 7fd0652516db91a78b98bb6495ac51833256cbc1
- SHA512 62b0b201623c32bbe24cec0d3382e02072648ac0541b506520bd33849d32381c2c2677cb0f605f75572db9fc5d48dac3929025c27492a4b8958b6f6b4777e64b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaDaEz9vD5TvinrmGZe0p4Ek4niOv:A3k03kHRJq56rbeW4SkZP4sz9MblI1q
- TLSH T193A54B16F6B84B62D07BC075C5D6AA56FA323C465F3087CB03459B283F277D19A3932A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$
- Size 2.4MB
- SHA256 38a737d5f028d514ff1b8b62f713d9f2d44c95d20b174b25ad09936bf3ec2e72
- MD5 7853468da10c0a494e00881a8719eacf
- SHA1 a445e54d4c4b87db50907ceff4ee9de3ff7158e5
- SHA512 0897ea04ccd198b5c3e30ddb3d888286e17870b825967a7d1b550a732b8a96ae571d69d03368b6499d9a6a263251490039344cbe2fd7fd43bf63378e4ef7a8ef
- SSDEEP 49152:A3k03kHRJq56rbeW4SkZP4sz9MblI1RZM9zfu:A3k03kHRNr7fkZclI1Szfu
- TLSH T138C55B16F6B84B62D06BC079C5D6AA56FA723C451F3087CB03449B283F337D19A3976A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
- Size 2.2MB
- SHA256 8e83dbde02cb533dbf0ed2dcf2aa20cd9cf5fd10e2ce0e17294c0c36763167be
- MD5 37625db74454dbfe346d488dbfe8b710
- SHA1 510d047625970795c52bd67f66af0f664d3d2f62
- SHA512 557719fa1569e1c21197652efdae84f5fe13064752b06e1ad74144a05ec922e26112fa73ceccf4d4e168d1dfb2e8a2983103366fcdab7d2c8806c16026686e50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaDaEz9vD5TvinrmGZe0p4Ek4niO8:A3k03kHRJq56rbeW4SkZP4sz9MblI1N
- TLSH T1A9B54C16F5B84762D0ABC075C9D6AA56FA323C451F208BCB1344BB283F377D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH