Analysis
- max time kernel
29s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 22:25
Behavioral task
behavioral1
Sample
2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
- Size 1.7MB
- Sample260714-2b96vaey4k
- SHA256 64e66445d60ed33b443d3d96a3ccade928c3729ee2f8ac8f9dd1a0ad6fae8804
- MD5 44286146766d3d2490804c56f625dffd
- SHA1 9c51319a23733092d1f441aa181debd520248416
- SHA512 3371505bde00a0e5c0cd3112f6226b182ac944b4e13b24f98d9d3607dcb588d25d09a2654fe858c347ad668f2e0bd3091350ee65dbd707a343a242009d2bf766
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDHfZe0p4Ek4niOkl/A04szE87JKTvm:T2agnTkLfUneW4SkZP4sz9Mb
- TLSH T1FD853B16F6788763D0B2C0B9C9D6AB49FA323C410B3086CB4259E32D5E377D59A36739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4400-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c475-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4400-15-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2700-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001998e-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b793-1771.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b152-2063.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c475-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c2-11.dat aspack_v212_v242 behavioral2/files/0x000800000001998e-609.dat aspack_v212_v242 behavioral2/files/0x000200000001b793-1771.dat aspack_v212_v242 behavioral2/files/0x000300000001b152-2063.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2700 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4400 2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe 2700 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_44286146766d3d2490804c56f625dffd_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4400
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 64e66445d60ed33b443d3d96a3ccade928c3729ee2f8ac8f9dd1a0ad6fae8804
- MD5 44286146766d3d2490804c56f625dffd
- SHA1 9c51319a23733092d1f441aa181debd520248416
- SHA512 3371505bde00a0e5c0cd3112f6226b182ac944b4e13b24f98d9d3607dcb588d25d09a2654fe858c347ad668f2e0bd3091350ee65dbd707a343a242009d2bf766
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDHfZe0p4Ek4niOkl/A04szE87JKTvm:T2agnTkLfUneW4SkZP4sz9Mb
- TLSH T1FD853B16F6788763D0B2C0B9C9D6AB49FA323C410B3086CB4259E32D5E377D59A36739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.8MB
- SHA256 a2a7667e385e710de992ed453dcbda9665d5eeb8dd3d0777d898a515849a17ef
- MD5 25d48498d0e0134ae662f971f79684db
- SHA1 8b76d92a8bcd144aa809fa4660b43464076a443e
- SHA512 cd66378b9df37fc957ec02653e33242210b344301ba47e65c59274b584516dc19cfa84409edae9fcfbbe04866b70f0aaa84a8ae0509b50bbe1149e9ab8b58dc3
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDHfZe0p4Ek4niOkl/A04szE87JKTvmOTjE:T2agnTkLfUneW4SkZP4sz9Mbjw
- TLSH T117953B56F67887A3D0B2C0B5C9D6AB49FA323C510B3086DB4259A32D1E337D19E36739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 a0487c37a1ea78ed4e7a390a03cb99bdc87129739ba7528f1e297bc05e55983c
- MD5 d4a9adca1966c945d22c8a6664d304f8
- SHA1 1225b5e67945bb8695045135ec02998bc9b4fbc1
- SHA512 6f9ad2ac5c5be4b2f2b03a6e33673a95fc57c35f8e04a43e9b70dcbcff20107bdcd74e8217bb3a1caaab7c954c9c1a7a3c222ec5e180d47d99c4cdeaa97f5032
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDHfZe0p4Ek4niOkl/A04szE87JKTvmy0Le5ji0hmM:T2agnTkLfUneW4SkZP4sz9MbBPji0Aj
- TLSH T17CB53C16F6788763D0B3C0B9C9D6AB4AFA3238410B3086CB4255E36C6E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 1.8MB
- SHA256 6429c031d05c07f11daec7422e9249c012f456c16255173ddefd8ba17db1c056
- MD5 9149ee9e943c95dc35c3588504dc0656
- SHA1 ba295c08d19314ba0472e15bb213e0832de21238
- SHA512 ed43a5f497d20ad24a0e79c919a9de4b146a13190ff41868f47a99e30cd814ff560ec8f2eb93c48df156164bd322d53764e78d04ffc173d08547ef579d655a6d
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDHfZe0p4Ek4niOkl/A04szE87JKTvmVM:T2agnTkLfUneW4SkZP4sz9MbP
- TLSH T1D2853B16FA788763D0B2C0B5C9D6AB49FA323C410B3086CB4259E32D5E377D59A36739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
- Size 2.0MB
- SHA256 8a353da364bc4f4415d658b9cac6543025dddc38ac6819b83424b8101bae27d0
- MD5 bcaf8ed96a02c16a82299f6120309672
- SHA1 b3d514c214fc29524cb683287cbe702f5fce50d2
- SHA512 00a949ef3a553b86e7b58b3909db0f61ef3aa3f704f8b150bd4e749be870023ed2a16a0d4ce1feb66ba1394c05e75d07e5db9f9516ff8edf9b329c011f697f90
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDHfZe0p4Ek4niOkl/A04szE87JKTvmgV+PAk2hMH3:T2agnTkLfUneW4SkZP4sz9Mbxi2WH3
- TLSH T1FFA54B26F6B88773D0B380B5C9D6AB59FA323C410B3086CB4255A32D5E377D19E36729
- MD5 SHA1 SHA512 SSDEEP TLSH