Analysis
- max time kernel
105s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:12
Behavioral task
behavioral1
Sample
2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 958KB
- Sample260802-wtdmpsvtbt
- SHA256 656d7147488c3a0529009ee26ce9ba1e00992dd508a6d3274b584c2122f75d28
- MD5 6ba08a39e8dbfc410d64907bcf46c0f9
- SHA1 4e5d17ba6d001d946fa383907790465b84a9cca3
- SHA512 b2bcb59b81ca1a989af6e011ed12fa1fefe6621c5833dc05e3869f032dcfc2da5a882b03e43eff9ad62131f22f3fae3c891e2d754e305385d1dbd8e7c8934777
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaGymN:A3k03kHRJ6RJf
- TLSH T1BE259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/944-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/944-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4812-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac30-1215.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000019cb3-1295.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5e3-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-40.dat aspack_v212_v242 behavioral2/files/0x000300000001ac30-1215.dat aspack_v212_v242 behavioral2/files/0x0005000000019cb3-1295.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4812 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 944 2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe 4812 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6ba08a39e8dbfc410d64907bcf46c0f9_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:944
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 958KB
- SHA256 656d7147488c3a0529009ee26ce9ba1e00992dd508a6d3274b584c2122f75d28
- MD5 6ba08a39e8dbfc410d64907bcf46c0f9
- SHA1 4e5d17ba6d001d946fa383907790465b84a9cca3
- SHA512 b2bcb59b81ca1a989af6e011ed12fa1fefe6621c5833dc05e3869f032dcfc2da5a882b03e43eff9ad62131f22f3fae3c891e2d754e305385d1dbd8e7c8934777
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaGymN:A3k03kHRJ6RJf
- TLSH T1BE259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 629eed2df8d253d0932ae5ca2c6ebf8112558d0448a6c6ab74291cbb2e21a12a
- MD5 5f9250ff3d6b6319d4b35281b51cabcf
- SHA1 9818e73c1f42137eaa89026a2a2039976d0cb18d
- SHA512 99679484dad2d929e3d98545c834737e55df6af6cee08cbc3b674731acf71bfe18c5cf0d3dce33d4121417648e1b33837a282bb18d62197b37baffdf5c9f2c67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaGymZ0Le5ji0hmxNrM:A3k03kHRJ6RJLPji0Aj
- TLSH T1BC657C17F6A802B5D067C1B8C5D29A5AEA713842173087CF1399C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 972KB
- SHA256 c7ed7ce64f59e8124f910e9c06ffaaee6e6768cd53aafc334a5fce3458a08c53
- MD5 20894414c9625e18b4d5554bcead3cbd
- SHA1 7536e71d8a3cc4b18b39a36b4afa77d22be28f8a
- SHA512 e8ea0109e79003d141aa59db7d89a94dd8e77bc3b5d4c128b7cfd8ce58ecc3a93a4cc29d87f696d1cec65edcde2563611c0e6030cb2c5ac3e8dbb2c91e53d003
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaGymLa:A3k03kHRJ6RJ
- TLSH T12B25AD17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
- Size 1.4MB
- SHA256 872c652f98b62875636e141e1f13c346d94b297c8c8bfbbd159b1664a69d73f9
- MD5 886d3c94e40537643b80daf6e3fc8156
- SHA1 50f1ee3c0a70d47b53bcf337ee90ddf533b9c818
- SHA512 59b92dcf1faf1b70381cab9a24d4930da81091856f677c027d48c6809b51a80d151a386dcd0229a0eb53ea68978ea6ef3609a413da4107ab1f56f38ce6a32a5a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaGym7i6:A3k03kHRJ6RJxi6
- TLSH T111653983AB469CB5F14D84349591823DA6777E2D07E356CB234E7E0A5F367C82AF8318
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 1.0MB
- SHA256 52f539fdf200bf0a449c8edcb38d06febd1f234e302f92ecb6a38276b1d72806
- MD5 709834e8e130fc29555ab31945ba81b7
- SHA1 3b66fddd7ecf3471df61dca187e4e2aa45f7619f
- SHA512 7b7f613921eea7fcea9d28be90ae09264bad113630b6fe0d9458b7beb3f673be57de806f3417c3858a7bb0662af55ca2166230ba0fd5236727ea23c659b837fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaGymZF:A3k03kHRJ6RJl
- TLSH T16B358C03E6D500E9D24A8134DE9A8A22FB35BD92072097EF2358B7262F727D07F39754
- MD5 SHA1 SHA512 SSDEEP TLSH