Analysis

  • max time kernel
    118s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 03:24

General

  • Target
    2026-08-02_2ba09cd136dcb182c96bf641aa2d9401_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
  • Size 787KB
  • Sample260802-dx8m5stbrc
  • SHA256 1d56483b38d04089769b0ff443aeb7f21dc97e94560966551a150fa79199e7cc
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detects executables packed with ASPack 46 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_2ba09cd136dcb182c96bf641aa2d9401_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_2ba09cd136dcb182c96bf641aa2d9401_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:5920
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4636

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe

        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 787KB
        • SHA256 1d56483b38d04089769b0ff443aeb7f21dc97e94560966551a150fa79199e7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.exe$

        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.3MB
        • SHA256 f7a7d39c3970fc8c3f00ceac537486a549ff2d8ba7939a5a6864087630ea6daa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 802KB
        • SHA256 a2e360c76e76ed9c69dbf17690b7c27fdba6398b1f5d26d36cbf9689ee19b9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 835KB
        • SHA256 014259093fb880665a6ed1cd9898a92b24248aca35a2dc031797a2c15279d714
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 811KB
        • SHA256 d3e24a7cd16dc19925c357370ccdebe91751ee0b2e6e4d93d13cc19e628d46fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 811KB
        • SHA256 288a064f5e86d297727773b229a3ba978a2511d327ad765ea5e009cfc0bd43a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 811KB
        • SHA256 a3e673593e01e03b939223d7a937f59896c47b8c0d7b94d939f151968b013c02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 949KB
        • SHA256 9c926cbe8c33ca4ce4ac06f308fb76366e5014733eb64c4f324c086b236a2560
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 811KB
        • SHA256 6193554d5ad636552d204f54555fa2e616075bfa4b7cb1a9f6d143196cbe0a00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 811KB
        • SHA256 234a9a90edb98e8f90f5fd2dd5d58275d7575be3a20b0510114d8de2e7286c49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 949KB
        • SHA256 4cafc51c29e16acb85c93367a063c918a2d08847d621afdc4455b7260a234c66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 811KB
        • SHA256 9e48df02eed596c894d995ec6f6cda6b9e67e1668eb9b948384c9f503b928df3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 811KB
        • SHA256 fcc2c511331c1282c1e7d65c393765b9c2da155b2dad0fb0223eea01e808517d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 811KB
        • SHA256 56f8695dd811269f6c5bb45296435757c69d6fade3afc5ef68a920f045069289
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 811KB
        • SHA256 0cfe1225ce29f7cd43930bc051ff1fe836aa84a27ade4158093265fd103f3fff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 811KB
        • SHA256 c80f2b099a96d485eb4fd22a9eb2a4827076f149a43a46d0a86062b3a4acde8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 811KB
        • SHA256 0603b4c4d78f153fd6644432a442a2d19d4a987f99eaa7fd4b78ad0f4763971d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 811KB
        • SHA256 714423741f2d19b1b1c59fdb4ec5224218f63fce57b4577b2cbe44338d814a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 811KB
        • SHA256 222a0bdc62cf7ab262381b3a093508d9ebe8d88325fd8909908d06e0f65c93c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 811KB
        • SHA256 00d59e8016d196e171a51a930f2a6522d7ff3cb344fa332cc5951c2c6cdc1299
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 811KB
        • SHA256 45bb65529960ef903cbeef34408eb87cfd8ab1af3519e1af6b0d677473411b64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 811KB
        • SHA256 49a442119eadc3de090fc199bcdf8f994254c44af70fced86b74bd8dbf50fc23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 811KB
        • SHA256 8d779be65321dbc7e40e7bdfcad25420cea249b859bfafa47640724c389a8d73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 811KB
        • SHA256 d4b653230f93bdbc1c81a049668741e4975fa2fb42f00a5433e166ff0b2f967f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 811KB
        • SHA256 c81cf7d0047f2adc40428411eb03ba2514f22f6535027c855be3188e9557ac50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 811KB
        • SHA256 daf56ebd6d91a384878288e5ba2fcfb34019905c33f8befa1f27dd3c91fe36ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 811KB
        • SHA256 7aa215a307f31a7f517e382d8e5c2b338f190f37775655bb4533cf8ff6d568b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 811KB
        • SHA256 161b61d712ba3ea8fdac19305b081540c5cf6a6e309eb85f1174da15fb63be6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 811KB
        • SHA256 03227c358bb1565b998985dd8f7e29e519a92074114c2780263c2ccc323bffb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 811KB
        • SHA256 3250f57e58d7580de22e49ade257b0b938c2878ebac8a1a2573dcba1f6a6ae0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 811KB
        • SHA256 b0d53f6c0f3ab90cb1880e919f8c12a47415a23196a8162b4b4861cb8d972bea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 811KB
        • SHA256 94b5f1cab747fd0803c9c389c1902541850b9af40384614e5a16862155a50b77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 811KB
        • SHA256 9a0ed37b3a0ebbbf60f8a21f9ab15d121f0bbf4112067682456680734e616181
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 811KB
        • SHA256 dc139241c0fd0c8c401e0defd108d491958f84f00c14385e8c95b78814683d69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 811KB
        • SHA256 366cb4fb5c587d732f592b44d336c97acbcf75079e0ba72c2214d59f86e05a89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 811KB
        • SHA256 8a8751c1d2aa7e4d13de5755492b53961b6a3249a4f9775162ce92a872fe954b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 811KB
        • SHA256 f6457de127762e6eed02006700a4798e41035fdcc4049d6712b3709c0d868d53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 811KB
        • SHA256 5e2133629785098bf7c53f02892c27f5441bf7838822c1b00bbd4eabbc29d72e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 811KB
        • SHA256 36f75a87f66911b29a92e0df73054f3010561d343d8535150db187d9878f29bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 811KB
        • SHA256 e62b960cb03f5e3665fb7b7b74c8e2ea0a1995b18c7c9585afa013184fb5b569
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 811KB
        • SHA256 66fed2123a91b10e8a24cfdee02dd8face4476a42c6abbf8d81c77b55f43ddfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 811KB
        • SHA256 28f2045e5cb74db4a991da8411a1fd6c95033c77224a33f3d076e699f1bf78f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 811KB
        • SHA256 64baee08d90aa5562dedb79ee6648953bd761da0387b355a94b03782b17eb68a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4636-1432-0x0000000000400000-0x000000000040D000-memory.dmp

        memory/5920-0-0x0000000000400000-0x000000000040D000-memory.dmp

        memory/5920-1395-0x0000000000400000-0x000000000040D000-memory.dmp