Analysis

  • max time kernel
    108s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 18:17

General

  • Target
    2026-08-02_6695caa7911f9cc573f0f9e8894414fe_cobalt-strike_conti_elex_hijackloader.exe
  • Size 718KB
  • Sample260802-ww233sdr5w
  • SHA256 aca6e4b18e878eb04786578a88ca7ecac0e365db436af6382ec666236ea680d2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detects executables packed with ASPack 48 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_6695caa7911f9cc573f0f9e8894414fe_cobalt-strike_conti_elex_hijackloader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_6695caa7911f9cc573f0f9e8894414fe_cobalt-strike_conti_elex_hijackloader.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4424

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe

        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 718KB
        • SHA256 aca6e4b18e878eb04786578a88ca7ecac0e365db436af6382ec666236ea680d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe
        • Size 835KB
        • SHA256 cc2c8f5ee2d7be54e5cf29b678aff0c3b573e79bfe188f839834f5ddf46fb206
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.exe$

        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.2MB
        • SHA256 196c5faae80a32716bdcfabd45f04dbb376f730770ddfd26471bf972952e0707
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 733KB
        • SHA256 9e3146eff2da5f327d466cc668f4466a49132227b5871f133796e96451ff2513
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 766KB
        • SHA256 843ad3cc0fdd225c5de203d0b09598ed9a0067e704c723a8010b75450001d360
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 742KB
        • SHA256 95593d0a3a44550381d50ae9703aa2980d78e889962c1fbbfb81d3d594b12101
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 742KB
        • SHA256 6d7902516583067774afdbce37ea5a4fed20b833d2a80a97419e8f804713bc87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 742KB
        • SHA256 fb8d8dbcdd1288e7a9513b21b36d35814881730018f24b0ec0376d19a404e7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 880KB
        • SHA256 bfc6188d53095098c28f2cb90f93d1b196d2c29f488efa49b7fe0af9c619662a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 742KB
        • SHA256 471c1a5ad4da009a9202ae3fd52ea43cee9e7e860f0d876b1dee212691c00c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 742KB
        • SHA256 1be98591d1a8a78612dbaf7391467affc0ee93ac77dce7468acf0fb0040a57f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 880KB
        • SHA256 65ed996eb8aebb17272e9f9272aedd40199444c25370414bc51f4c2a32908fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 742KB
        • SHA256 09e18a9ce6337f85612564733ce3d5e4f5cb40cd4e15824bed5745d9012d1a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 742KB
        • SHA256 697f7fd230ba1b1e6c3d3c34155bb547da8adeb1f2865c58830a3c16032a0231
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 742KB
        • SHA256 69b6458de3a18b53a2812ee0315d9449ffa4cf89239a3341d1efac8c6b420eff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 742KB
        • SHA256 f6d74c09b9b00c70a83c3ff9f69dad86663480a16694b062b4eb7df51ea09aba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 742KB
        • SHA256 d204a6678e82054a2ec043c77bd85fb721391420d57eb0960a7d9b2ec978cbe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 742KB
        • SHA256 c92b4007c59a0bf6293173acc974c069d90a470a416d9412fda9e6460e6bb2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 742KB
        • SHA256 956d813eb8fd0828b29c943e2ebc3da04d38758aaa298c1b11c2d797ca4fd6e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 742KB
        • SHA256 d9985f12fa237354590c798feae20fd744e336e1e03474bb3eb999051960d4f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 742KB
        • SHA256 b9781206c2547510164a7ae7553a19c3784abd72c78d90d2e2bd7794e4e2bf93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 742KB
        • SHA256 6e38de59f038613bd8eb6a0507d80916cad2bfafd2ad3be152a1c09c03ca66b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 742KB
        • SHA256 ef5ff935c9f73c86917c964c4de79b1988efed34d1abcee24545b23c87b16881
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 742KB
        • SHA256 ed3a0c3b86bf5b6e647e193766c2630aa8849c0d98d3959b61bbc7894eed6ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 742KB
        • SHA256 cf447d8b1695bdfd7cdd1147385002b7bbf0000f03eb6700dbfe4f4ae7bb2b69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 742KB
        • SHA256 57fc33aae5d8e47e4747295bdda88f1f5ce8109ec46833d4ad04b0eef9228cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 742KB
        • SHA256 cd4f95a4ebca4bd4951f81d54f36dad3a486bc3a719345f6987b42748de4f39c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 742KB
        • SHA256 206c5ac95c037bcd0b34e5f282f01df801213d23a90214d5adcac97202514553
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 742KB
        • SHA256 5af674a0240967974e2f60946202fddaceedb67ec2bff429a611cfba8ef2a938
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 742KB
        • SHA256 6da6af8eb37737acd95afcc54261f16fd80390ca8039bbb88ba2f03b3ed515d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 742KB
        • SHA256 7ddfdd8f74a7d44d4f294153f927489dfb134f77d9ad68481bb7fbbf09c5caf4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 742KB
        • SHA256 6754d1742a9ba991548ac6602af8257a64d47a7a37b86b7c2587fd6ec7ddcff1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 742KB
        • SHA256 b65faf26313b877fe749670bcc21ddb7466c7c52516bec6488a83bee0f31091f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 742KB
        • SHA256 6b9aea741f9a2dd178d9df6d4fb3d2352ddedb6637b9cef6bf5c9f29b16ab71f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 742KB
        • SHA256 c6cfecba70f77a61524af717898e4b84fc186fd346da7700788f60b06f54a68c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 742KB
        • SHA256 be7a509eb4a20b6cbf53af3027ab368d0f3dc0111b182e12537a0d1d401ea259
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 742KB
        • SHA256 a3ea2da4a776897242ef0839b3e2d31565bec5812fb02e78e5a87b1d08199e35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 742KB
        • SHA256 f28b6f687097b9c94e7122cd94b68562ab9f70dfa3a70f939869fc2f211906d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 742KB
        • SHA256 4fa63245d4eec0845caea4de11d8f736a084fad591ea6a1994197e294be7c089
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 742KB
        • SHA256 f9b71aff047e219d5a2fa2e75fa9022da2999ccffcd67d63582452d3c3c223dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 742KB
        • SHA256 a1530285d706440600d62d2b1ac3d42d9d9b38fa547238729b04a5c8e436b690
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 938KB
        • SHA256 86c0ea2f7fc4ff5ad63feb595921d467518b16a22997ad80690c905b56812560
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 742KB
        • SHA256 8f66bba1e586477d8c44078933292eeee4c65cbb4b77e51f4ca7055d387ff07e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 742KB
        • SHA256 9fe7bd9e3385ee266b47b8e9afb04e74b21a84eed30031b04d1890ec282c6269
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 742KB
        • SHA256 710cb43f059dfb95566845830f6950e4820e718a66a5f5ffd792fa5730c5f586
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4424-1396-0x0000000000400000-0x000000000040D000-memory.dmp

        memory/4464-1394-0x0000000000400000-0x000000000040D000-memory.dmp

        memory/4464-0-0x0000000000400000-0x000000000040D000-memory.dmp