Analysis

  • max time kernel
    109s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 14:04

General

  • Target
    2026-08-07_7d25af7a0b651425b3724ed2591a5b13_cobalt-strike_conti_elex_hijackloader_vidar.exe
  • Size 535KB
  • Sample260807-rdeslsfj9y
  • SHA256 9218ab4797fa3f9ce55370e32514fbee2c3a4abd0d3f045b34912238db89ebf6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detects executables packed with ASPack 52 IoCs
  • ASPack v2.12-2.42 49 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_7d25af7a0b651425b3724ed2591a5b13_cobalt-strike_conti_elex_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_7d25af7a0b651425b3724ed2591a5b13_cobalt-strike_conti_elex_hijackloader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3136
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:1140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe

        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 535KB
        • SHA256 9218ab4797fa3f9ce55370e32514fbee2c3a4abd0d3f045b34912238db89ebf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateOnDemand.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
        • Size 634KB
        • SHA256 c1c383260017a261b2e387ee6843d930e0ea053a12d4668323564fcfbd47310e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.exe$

        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.1MB
        • SHA256 348e6b87cf8e21d45ab6ec1da9e9fa5de9175dda50efa6e92df4e2e9b1af470a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 550KB
        • SHA256 aee918bd0ae5f22b5f7b00aea77ecbaa1c1835a9d74a772ed3fccdcf0abe7433
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 583KB
        • SHA256 6a9b9e36221286ea97cf01e565722746a5e41442b7be368112ea87763c763325
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 894KB
        • SHA256 1ceee1799edb22f95bf2253adb40326f06f08369c1c44dffc3e23a2b6da556cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 559KB
        • SHA256 c7a38fbb5215f5d56630942b6e71912ef6e25d6752aa0be0069dfa1edece4da7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 559KB
        • SHA256 02bdd64df842c79f3d3f0bcd46ae1008ad184dc6817bd89dbbaa372f23ba5c0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 559KB
        • SHA256 063d87eafba68a555471fd0f1aa31c22069cb818f6af59eba5040152f678329b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 697KB
        • SHA256 28243dc6f2b3da28aac363dc324e8ebb2bac195122cc3fc8496a93239e5d0fea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 559KB
        • SHA256 706809af46c7898bc72160a3285816ec7b39046b2f2709e7b24fb3744fe93aae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 559KB
        • SHA256 e0e716cc0bbebbf8448e24d5cfc19fa5ef8c513d68accfeccfd019111965f843
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 697KB
        • SHA256 ffaa4c0d6af5f1d93993e4cae544023ce4994cd92050db2afdc9d999d807df3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 820KB
        • SHA256 e1b966423d0c06a65c7aa3549d4ddbaff2bd27961a35e0afe7983358c01e9ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 559KB
        • SHA256 51bae8cbb9f942596cf92d3bad2e22ddb276e0d759c2cfbb4a9d5e4e8cc34655
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 559KB
        • SHA256 860fff3ec4dfa9728035612c19defaeed1c95137f20ead1fabdffec79136e365
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 559KB
        • SHA256 3d8a071869f3802743a3fb9d0250f0573b3cb0934057d24544b099bad2f3cb8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 559KB
        • SHA256 b7315e63ba8cb508d246d6d331057116aa411dd026a3ccf0e7e00c6f910f4718
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 559KB
        • SHA256 20f800570eaf28609f6ad9b2a30c4fbb2e458e2d5f35775c2c3c6650eadcfa67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 559KB
        • SHA256 fcf5b3a68131916e6c7995ecd01f8aa58d89391d2b5d1920edd972bf4692cd76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 559KB
        • SHA256 89deff9f933929fc5e08d674a96db6191105046125b60217bba95ad9c9fd404c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 559KB
        • SHA256 7293d976e9cbceb436db6d64528ef4bd7332fe5b55710df6c682c26af5a02f65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 559KB
        • SHA256 7afbafd8ff0f3c4dfd506ab08717d96b6d84b748e72895c76330a611684b0316
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 559KB
        • SHA256 2b8b995b50ab8ec96aa5707e934f81ebaddacd77503c060f8760938cf6ba34bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 559KB
        • SHA256 753df4d147edb183d81e37e0dc2d5f1e9676f0db6b4def515f0dc50a63e159b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 559KB
        • SHA256 7e8aabdf6f177adb2150da676fe20446f6693c03a846546b0b707e6f43306d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 559KB
        • SHA256 44107fc8799d8d638743213cfa04e450064903d46b9d54442d490a4080906efb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 559KB
        • SHA256 c1a21aae01aecb945e02c6dfc073e8856c285fc09d5d7658951f33d58a5e4919
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 559KB
        • SHA256 0d316cdd7735f914c8a09e9fc8df1f05045fb75efc00455f66ae69d646095d85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 559KB
        • SHA256 1541c73517a57204f7f456ab5186259b4fe54432e1d8799435f39ec0a85228f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 559KB
        • SHA256 927f8c4769a145f6f3e10d576b7219bd697acd36eacad14dd6014f6280d59c54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 559KB
        • SHA256 7e7acf71c234d651d18e4fe02a11c11bc2280b1ece1a911d8e47efd60685c004
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 559KB
        • SHA256 d1c1f07f296db9d0d6357a9a5344cd858e155cbee39eb00df8d51794f42b65e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 559KB
        • SHA256 4305cd15098b9584e29043c8c9c0446d7e7f2458e1e6e0f23e48bc5fc77263ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 559KB
        • SHA256 7c09afdbfe9b7dff7b8a072713ebe6c5ca9577cbc5377e328d4a27adf61dc3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 559KB
        • SHA256 776ae4b1dcfc256767cd8b2a5d15b4e9a9b540050e8b0fe539467d8abc864bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 559KB
        • SHA256 cefb787ecdba695c03dff4e7b42ce430435e7d805e4e09ac1726a2b6bea79040
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 559KB
        • SHA256 d83d27ee20b003546491d66265da272811ecbcbaebb33e72312ea9525b580378
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 559KB
        • SHA256 143eb195661490cd5e2517447b10d4d32e96eb042b8ddf035fce86f6f9f0ecf3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 559KB
        • SHA256 4a0d8b0de228bec9006201c1c5bfd9fc073ab64ac370bea7465f1be5f1f105fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 559KB
        • SHA256 6a704ec068847c0074fbaa0e83881b99209752032aea67a7d514c7b4ead4e364
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 559KB
        • SHA256 d144998e02ff2e873bfdbc56735805d9e4dc72e195e95d83bdfab6fb0c99325e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 559KB
        • SHA256 a418849dbea32e64dab117f190e48028775e58e4dbbbf401406807086e47028e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 755KB
        • SHA256 576369679f5857252126289019ca2a7948e794e08076b6f900499926cefe1951
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 559KB
        • SHA256 6f51baad87cb219000b530965481c2a353ae9cc120d4539c53ec370a512780f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 559KB
        • SHA256 b28f33a1dc3c507ab97df9e1851e314545bca83a040c47247ec22859da055a78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 559KB
        • SHA256 db3880fb6ebe5cb55696fabce10a9fbd65fef1456461141c29896f7ddeedc2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vlc-cache-gen.exe

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
        • Size 676KB
        • SHA256 a17dcc7d1bfcd44e703c9ed69ddcfe188dde74836345a5cc7c430b8031f1a04e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FileSyncConfig.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
        • Size 788KB
        • SHA256 b090419809323e0c88bdb6f80abfabf2bbcde41fa93e7364ba0b089ee9d52804
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1140-22-0x0000000000400000-0x000000000040F000-memory.dmp

        memory/3136-0-0x0000000000400000-0x000000000040F000-memory.dmp

        memory/3136-21-0x0000000000400000-0x000000000040F000-memory.dmp