Analysis
- max time kernel
117s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 17:40
Behavioral task
behavioral1
Sample
2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
- Size 1.3MB
- Sample260721-v855tsyydx
- SHA256 9c527b8227f7ad8f2c05732a939f3f1ebd50cf9359fd152c699bf75548f5237e
- MD5 1844d6a59dec5f9d98ef56aa07cfd096
- SHA1 6fdd5bc0d6831f935d86f898f60fe2431525d39b
- SHA512 83791c14d69147a5ab9654264d5ca25d6664ba9183fd90edae614ec0a387782e466503e10c7edd7c919b616324acf9727dda56c47794164cb5fcb22220b1ba03
- SSDEEP 24576:2IifqFuhuIifqFueIifqFuh4PoD5TvinrmuI1H:yqFbqF7qFq56rDI1H
- TLSH T17D55170561894A69CD5F8E3485A15272FA23BC5F7F2D77DF1E40BE263E33AC06A25207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/1476-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c599-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2816-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1476-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0b5-1023.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d26-1251.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c599-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001a0b5-1023.dat aspack_v212_v242 behavioral2/files/0x0003000000019d26-1251.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2816 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1476 2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe 2816 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_1844d6a59dec5f9d98ef56aa07cfd096_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1476
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 9c527b8227f7ad8f2c05732a939f3f1ebd50cf9359fd152c699bf75548f5237e
- MD5 1844d6a59dec5f9d98ef56aa07cfd096
- SHA1 6fdd5bc0d6831f935d86f898f60fe2431525d39b
- SHA512 83791c14d69147a5ab9654264d5ca25d6664ba9183fd90edae614ec0a387782e466503e10c7edd7c919b616324acf9727dda56c47794164cb5fcb22220b1ba03
- SSDEEP 24576:2IifqFuhuIifqFueIifqFuh4PoD5TvinrmuI1H:yqFbqF7qFq56rDI1H
- TLSH T17D55170561894A69CD5F8E3485A15272FA23BC5F7F2D77DF1E40BE263E33AC06A25207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 eba40aa868f4029d53133cadca065d462db30ca914837ede9915344b717ff7e5
- MD5 558cf0fe7d4a17cf866a8e495c88f78d
- SHA1 b0d2b7297761cef9254d56afbf7f7945a75d1361
- SHA512 3ed56533a8c6da5e9920a0d81d2249218e7c4f7a82918aff84c3e4701af4a0a45295b7c3c829ffe42c8b234c17fb407c963e6ea20e175a9f0843c8795375ab26
- SSDEEP 24576:2IifqFuhuIifqFueIifqFuh4PoD5TvinrmuI1D0Le5ji0hmxNrM:yqFbqF7qFq56rDI1DPji0Aj
- TLSH T1C6950715B1A44625CC6F8D7485925672F9327C4F7F2DB7CB0E40BA293E33AD19A36223
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.4MB
- SHA256 ef0ab322317c2b17662b19c5a3515d4fb3acbf25bf437f9bc243cbe2ea95c34d
- MD5 28a943da601cb967efe93233052e3641
- SHA1 803af9e548d7a98ea491d0ab420f28154e816a31
- SHA512 70915edfc90920e219bc0033b9eeb8331e7ab5ca7d029590fe487dd1be405a2bbc33c12ed91b48d46b19cff03de2ae0e61a3ecc7f83ddec54bc68d511f65b4d5
- SSDEEP 24576:2IifqFuhuIifqFueIifqFuh4PoD5TvinrmuI1uwE:yqFbqF7qFq56rDI1E
- TLSH T14865060561894A65CC5F8E3485A19272FA33BC5F7F2D77DB1E50BE263E33AC06A25207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.4MB
- SHA256 07eb63e4d70936fb2d328300dc717a09073c2ae40d321c1937d57e214d0913b5
- MD5 21587938db6f1a48449e123ccaaa54e8
- SHA1 026986f5e954b5e65569d5cc04829cdb0a227999
- SHA512 dc38742ef3c619e5a644aaab099755b38cce0a943749e98dc8262da1be67c554855af27a9181d7c0b436138d55a6149c7a794fe7065b581c7b22f3f337538628
- SSDEEP 24576:2IifqFuhuIifqFueIifqFuh4PoD5TvinrmuI1PF:yqFbqF7qFq56rDI1N
- TLSH T1F265F60161894A65CD5F4D3088929672F923BC5F7E2D7BEB1E50BF363E33AC06A25217
- MD5 SHA1 SHA512 SSDEEP TLSH