Analysis
- max time kernel
112s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 16:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe
- Size 973KB
- Sample260810-thfxkssdrb
- SHA256 597f0e59cee1b74ab712f8f167e8de86ab38be351337a57002b5c66c41a990d2
- MD5 e7939c7e7c67ed529fa5a24414534d58
- SHA1 41b9200d34cc0b502b3d8de708cee5cd7013de08
- SHA512 3189a7e242b2b7b1766cd506efd1b5829a085e80a4784a829f323c95aa61a5365820f88064507be3e1fd0bf1371a3c4fe6f9323b8fa86397736bdb32e7bf5603
- SSDEEP 12288:cPE/F5V5KV5izrqFkbQX6IjUl54G2nC79Q1gL5pRTcAkS/3hzN8qE43fm78VIcF:J//IifqFuyDA54GX79l5jcAkSYqyEIcF
- TLSH T16F255A16F6608679D073C0B5C5D2A7B6EE31384547309BDF1389D7282F23BE69A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/796-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b871-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00530000000167e7-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b0f-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019ce0-1021.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/796-1400-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1216-1431-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1216 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 796 2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe 1216 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:796
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 973KB
- SHA256 597f0e59cee1b74ab712f8f167e8de86ab38be351337a57002b5c66c41a990d2
- MD5 e7939c7e7c67ed529fa5a24414534d58
- SHA1 41b9200d34cc0b502b3d8de708cee5cd7013de08
- SHA512 3189a7e242b2b7b1766cd506efd1b5829a085e80a4784a829f323c95aa61a5365820f88064507be3e1fd0bf1371a3c4fe6f9323b8fa86397736bdb32e7bf5603
- SSDEEP 12288:cPE/F5V5KV5izrqFkbQX6IjUl54G2nC79Q1gL5pRTcAkS/3hzN8qE43fm78VIcF:J//IifqFuyDA54GX79l5jcAkSYqyEIcF
- TLSH T16F255A16F6608679D073C0B5C5D2A7B6EE31384547309BDF1389D7282F23BE69A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b06e121b57f68aa90956c69ee01fd685fc528b3fc947d05953bc4e40e04c2d86
- MD5 576140af579b06286cdae5ae779d50ab
- SHA1 d23ff469b0d33b3edabbe24e15b6bc2a172d1d1b
- SHA512 55d3eb269ea7b57f3dbd7791ddfc567b611fccab233f997d1ee6ef798079de79e4f1a0e8a648a2c15b2bcdcef17c8c688a21515241963640e068ac4d7be967ca
- SSDEEP 24576:J//IifqFuyDA54GX79l5jcAkSYqyEIcB0Le5ji0hmxNrM:9qFUH1pYq1Pji0Aj
- TLSH T1AB754A16F6748675D073C0B9C5D2A7AAEE31344257308ACB1385D7782F27BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 997KB
- SHA256 cfc049c11fed479b02d3acbf77c8d4dade13e455bc402b63e036bb5c4faad193
- MD5 c2f3f2c1df4b5abdc92f63a78f3e8714
- SHA1 a5fe469ea525ddd917133c877ffe80dc093d6e6e
- SHA512 7e9020e8dc3455f5d402eefe22f46defd865abe28532dd2519ab5452105b8884b5ffc024f75eec3f09489ab5021cdb6884c483b243516c57dfad49065ac75d4c
- SSDEEP 24576:J//IifqFuyDA54GX79l5jcAkSYqyEIcpY:9qFUH1pYqW
- TLSH T11D255A16F6608679D073C075C5D2A7B6EE31384647309BDF1389D7282F23BE69A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe$
- Size 1.4MB
- SHA256 da3fe1526daf6614b87f66de2fc2688b3160601f50e66ec3132a379dc00ef1b5
- MD5 4185417b7dfc2bba1db6025b2200aa67
- SHA1 3277136d19a7ce945096820c6d932b3098ab9cb8
- SHA512 140b86530a2198ab756e5b73c32e96841c9d8b141f2bc5ee9b7853c48864e31310b9fbe4fdc3ac2be957e62273681c6f38a48edcd575f3b9f35d5352b8cd608d
- SSDEEP 24576:J//IifqFuyDA54GX79l5jcAkSYqyEIc13Td9CHKy7GZO:9qFUH1pYq5Td9CHKyao
- TLSH T115657C15F3A445B9E073C175C9E29666EE7278451B308BCF1398E6292F33BD18A39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1017KB
- SHA256 bd280889e0c29b2f23b095473f9d537bc8ba604f3b3b8c03d5a3e76fccf6e071
- MD5 c2fdc37775e362c2478ad0e845b865a5
- SHA1 ea88471410e4692df2516c609198daee08cc5b9b
- SHA512 b6eec93100136e1e6dc3c8ae70df5abc49594d895116dbaa253a70cc95a0eb02dddd0e4a3405df88627e9fd7494c9811034dc4ac3484ac98aea1cced0d1895b7
- SSDEEP 24576:J//IifqFuyDA54GX79l5jcAkSYqyEIccwE:9qFUH1pYqa
- TLSH T1B9255B16F6608679D073C075C5D2A7B6EE31384557309BDF1389E7282F23BE29A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH