Overview

overview

10

Static

static

10

2026-07-15...ar.exe

windows10-2004-x64

9

2026-07-15...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    113s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 02:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_50ba4bf11ed333052da7d3b3aea084d2_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 864KB
  • Sample260715-ddtpwads2x
  • SHA256 046819f274851f6cd90edce233cfcbe4d2885754d9613de43c5c203824d040d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with ASPack 49 IoCs
  • ASPack v2.12-2.42 46 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_50ba4bf11ed333052da7d3b3aea084d2_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_50ba4bf11ed333052da7d3b3aea084d2_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4312
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:2668

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 864KB
        • SHA256 046819f274851f6cd90edce233cfcbe4d2885754d9613de43c5c203824d040d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateOnDemand.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
        • Size 962KB
        • SHA256 a031e7a91e23af100ab23837dc47a49330ccc07e7029535dcee9ff0c3b2e45dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.4MB
        • SHA256 b4fdcabd31f1e4b14ccda0ff4fd274d682d994c58c940beebbe1f6cb7170de0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 911KB
        • SHA256 5b2c17db9e8d92af7deee8502e75ee1872243728080ea0e0156fbc6099d8ba8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 887KB
        • SHA256 eb1fa9f65d56c1b930316d61dc888cafa82ed001b370e16a8fa8b0c8e5a21ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 887KB
        • SHA256 8d48607892467c65e4e55a66a85384030c20235463b091114f42564245239e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 887KB
        • SHA256 eeebab2905b69ac2694fe49e25abe2ac9ad32215f1d69b8465f3cd7d53eb5a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 887KB
        • SHA256 1c725ca8847c728c46e748c5837f08ead09e811320ae642255e11810dc98dce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 887KB
        • SHA256 7dbe2435498d1147e6c6ef4e2c1ff49b74952cccdac1e25d3a236cd66ccceac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 887KB
        • SHA256 d0ca04c63f66e61f19266e5054b7d315efde969f43a343ed2624d32bac7d74e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 887KB
        • SHA256 031042744a8951fcea311c66b2d02132177f6cc6e83347bd6224766964780e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 887KB
        • SHA256 288031535308e70769f22ba8b391b28b106854fa893758362dbff937aca8a84d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 887KB
        • SHA256 73d5477e8087c824617efd4971a687d09317e1531aadacaa5928640ed65a1527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 887KB
        • SHA256 0375ecc4f2361bee3736a2c84e4fd0a3b94ac35e2cef08cadae6e0643884ce80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 887KB
        • SHA256 9a08c345cf4a8fc51164abe29604815972e33fbd971b64e7e502ce22d1870aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 887KB
        • SHA256 1e7ebd4e203eb819ba6df945442beac212d39aef7a36cc32819537ade1b915d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 887KB
        • SHA256 7de26ceed957d49ebd4b90805e65cd6ae2c24081ce81b62e75749b1e708524e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 887KB
        • SHA256 700faf784793cbde08c7b47e7f8b78a32fdb093d7d971c94c1f989f6ac65b8bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 887KB
        • SHA256 206d7c7d6da5fad2be57f63dc5dd8597c69619b7e82d1b0149f6f823e7db71c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 887KB
        • SHA256 e07c04873455f046dfc6d7eeca0d90c20a0687d5ca809d182fcbd8ec24b09ec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 887KB
        • SHA256 419502357ff278ccf82a7c0d6d823ecd83a18d1065e571ba7bdd2fa6c60bc871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 887KB
        • SHA256 5e69e3b830945041073d7b8a3b638749473872af311d9f2c7ee2252feb68b083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 887KB
        • SHA256 2cedca28312dc1e37cc21d8047dd67b50216bc5778c021b3bb58e6a5d6196e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 887KB
        • SHA256 13e20e8a24bcc8715c2fed25b769ec23f2adbc32ee514b74de01d8e533a2be76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 887KB
        • SHA256 d602aced5babcfc093bb0be35745eab8d073c36bc3c72e4e469a9af9c4c96eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 887KB
        • SHA256 c5efafbb26203cfe9671fe81a3c6ffddcc2812e854138781155e77b5350d7dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 887KB
        • SHA256 2588631dc85bcb9cf7989424c5afb2f64a2d5654cfe6187ef916ab06affde593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 887KB
        • SHA256 11e754e860b7b4550c2e4769c30e38beeb33ac43578d1b5621e8883f7f302b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 887KB
        • SHA256 f84a84fa4772706dd05057a47d699e1cbae99acab68dd0869fb64103c1b7a665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 887KB
        • SHA256 ca703c1c4c237c50e0a33c28d8e7ab32b23d88aeb5d84d09165cbee53774da8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 887KB
        • SHA256 d9ffbae30ef3318d8c529b270d30aeb1820d1f829fc241935366807dd1adf206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 887KB
        • SHA256 658afcd4dddb08dbb65614580225bb193eb4db74dfdf2fb93bc9aaa6420535e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 887KB
        • SHA256 2077408c84b01a71987d2393b2304b471ecaae78b57e55817aeb1e064039ed76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 887KB
        • SHA256 3464a6c0d415ab95cc193fb8e4311b5c31e815ac21185f2a1d564221015d8e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 887KB
        • SHA256 7e06793a6de114bc0ffab8be18d460e00c0f40f036e9315a4448156987369e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 887KB
        • SHA256 08197678456b44a990e77af2bfa4ecaeec3a329001b360dc4937e62b3e2921b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 887KB
        • SHA256 7a14efe977c171ee570ebfee47da812043bd0d4343f09d504e1f0b513499bc0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 887KB
        • SHA256 07802063ed6479fddf4e3a7f2688641af072e11224930b73a7293bcef1ea5880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 887KB
        • SHA256 afd69188e85fda4134bb6c8966790a36710bc8e1ee07de43b2f0e656fcdf2b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 887KB
        • SHA256 17ec7b7bbc47a2b6868304a087a0518d59ba27a455fafe1de8e48fcf7c18b2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 887KB
        • SHA256 dd2e6ede515b565a838dbd3032eff9f22b25c6bf89817dfa4c1c95897c354f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 887KB
        • SHA256 3e14608c82871ffdb2798322c86f9273468fd7f7b24515f3facf3047eecd7a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 887KB
        • SHA256 1d8c09850e7e762e030817767e241a37be3f76a4cdf6cd93f38e24b74af9d2df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msouc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
        • Size 919KB
        • SHA256 21fc9c0a6ce28b97417e603a26b8a426217d6afde01b71187a85f0e834a816e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmadminicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
        • Size 925KB
        • SHA256 9843ab25473da92b85d39d6d66c43a2b239814c72759188758aeef37a6cdf469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sscicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
        • Size 943KB
        • SHA256 f23cd45049969c710b26886ad3c263fe0ee2fe0dcdf33c77b64a7c70e5f1b19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2668-22-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/4312-0-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/4312-21-0x0000000000400000-0x000000000040D000-memory.dmp
        Download