Analysis
- max time kernel
113s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 15:02
Behavioral task
behavioral1
Sample
2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
- Size 1.6MB
- Sample260714-sek7fsft2m
- SHA256 f5c493160625dace5185bb4dbc7e17a74f1bbe6d71481d8f28a170152a768409
- MD5 0f61c2ca451f972779a07ced7b3d7b31
- SHA1 256c0ba25a46be197f8913456db8cc75c9c9c053
- SHA512 d169ad59fd89205645199d524ffae75b7c7d30526ea5706ec88bec5ee89cc845515947ddfe96b64dcce3d963845ee8e3e79a4455a5958bbf7f561278fe668f82
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDr1YTqMi8CtBd2QHCHmTBW5sD:T2agnTkLfUuqJtb2It
- TLSH T1E3753822E66486A2D0BE8474CB929645FA333C510BA086CB92D5F33D5F337D19DB6723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/5816-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6f5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5816-15-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4568-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-320.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b6f5-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-318.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-320.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4568 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5816 2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe 4568 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0f61c2ca451f972779a07ced7b3d7b31_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5816
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 f5c493160625dace5185bb4dbc7e17a74f1bbe6d71481d8f28a170152a768409
- MD5 0f61c2ca451f972779a07ced7b3d7b31
- SHA1 256c0ba25a46be197f8913456db8cc75c9c9c053
- SHA512 d169ad59fd89205645199d524ffae75b7c7d30526ea5706ec88bec5ee89cc845515947ddfe96b64dcce3d963845ee8e3e79a4455a5958bbf7f561278fe668f82
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDr1YTqMi8CtBd2QHCHmTBW5sD:T2agnTkLfUuqJtb2It
- TLSH T1E3753822E66486A2D0BE8474CB929645FA333C510BA086CB92D5F33D5F337D19DB6723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 4ac822340efb72bf6a8708decf83c02c17c4f1b42d77132c35d9e3d3ce894b25
- MD5 b51b6388b700156df1b8a31d86dbb5b2
- SHA1 e5fe7a017c1f68cf7eba898f885d1bed11047ba1
- SHA512 bd8e35543607b54be27b3568f176c3e6192f883f264f46b9b0b1c0dbdb946f629ddfdfb48078fc258ef1c1de09ed7b04d61feb1175a74bf80be7b8ac3afb2a5b
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDr1YTqMi8CtBd2QHCHmTBW5s/0Le5ji0hmxNrM:T2agnTkLfUuqJtb2I5Pji0Aj
- TLSH T197A52926E6648661D07AC0B5CBD2964AFA333C410BB086CB52D5E37D2F337D199B6723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.6MB
- SHA256 28ae5fcdd98a28468d5b60f9f955647df78abaf90633e2c6793cfd3067639e5b
- MD5 b2b9411531468e5e061558286161496b
- SHA1 ffd06528e918d6d0f4ffd14066d9fc0ea53ee09e
- SHA512 c495c3e6cf8302b8b6a802bb6644c00b960923766597fe9d8e3d3a79ebbf7892bddc91157be40fa145b9c47147354e6792ae5d5efbcff1194f63088cc2cf8803
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDr1YTqMi8CtBd2QHCHmTBW5sZu:T2agnTkLfUuqJtb2IW
- TLSH T148753822E66486A2D0BE8474CB929645FA333C510BA086CB92D5F33D5F337D19DB6723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe$
- Size 1.6MB
- SHA256 09ec07964385fc1c4c9b3fcd47a2d38bf412bd2108a7735c1c55ad1fe57fc472
- MD5 0a022d834bd18d12a5281bab4a0b55b4
- SHA1 0ce59e2fe07f09f44f711cba617dac702c76f3a5
- SHA512 1da0458900e04353023a1bd6afe2b61132902c1a1185df68fe94956b515638b50df7ba9c0d947bfcc0d331a3acc75531a5e36f03f488bb7160200e1fba10292b
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDr1YTqMi8CtBd2QHCHmTBW5sfT:T2agnTkLfUuqJtb2Ih
- TLSH T118753822E66486A2D0BE8474CB929645FA333C510BA086CB92D5F33D5F337D19DB6723
- MD5 SHA1 SHA512 SSDEEP TLSH