Analysis
- max time kernel
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 12:52
Behavioral task
behavioral1
Sample
2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 958KB
- Sample260819-p4ejesvbla
- SHA256 e4278f00dfe5c2d09cd98ee5ca49c3fe636c2c2233f872f231abed065848a78e
- MD5 aa35f0a5182699226c8e70c85084ae3e
- SHA1 7d0309031393caa0aeb986208ae4fa1d5871f489
- SHA512 98d70516db7caebde710dcea0c61f9f10698ce7242604fc306574884ef397a1835723ebcab6538ac5e948f2329a10550abf16ba22953a34fa9918584828f5dda
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsiN:A3k03kHRJ6RJ9
- TLSH T1D025AD17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4520-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c52a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b311-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4520-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3452-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00200000000188d7-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac14-1212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00110000000064cd-2044.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c52a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b311-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-41.dat aspack_v212_v242 behavioral2/files/0x00200000000188d7-426.dat aspack_v212_v242 behavioral2/files/0x000700000001ac14-1212.dat aspack_v212_v242 behavioral2/files/0x00110000000064cd-2044.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3452 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4520 2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe 3452 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_aa35f0a5182699226c8e70c85084ae3e_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4520
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 958KB
- SHA256 e4278f00dfe5c2d09cd98ee5ca49c3fe636c2c2233f872f231abed065848a78e
- MD5 aa35f0a5182699226c8e70c85084ae3e
- SHA1 7d0309031393caa0aeb986208ae4fa1d5871f489
- SHA512 98d70516db7caebde710dcea0c61f9f10698ce7242604fc306574884ef397a1835723ebcab6538ac5e948f2329a10550abf16ba22953a34fa9918584828f5dda
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsiN:A3k03kHRJ6RJ9
- TLSH T1D025AD17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 490867c3a80980f1a55281eda5e61e746b4463fe3ec9f365061172bcd2fdbaa5
- MD5 98a0d5426baf2bb5c52fa96f60353cc7
- SHA1 7cc9a5b193093079219cf893684b9133a9c32fa6
- SHA512 179e61b4d27a4798d528d71ce0990e8f036572812637e6d36712b39dfda12bdeeebb212707f72eab7c7302625c5734483107c83f3705b0cc01fef7822849a638
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsiZ0Le5ji0hmxNrM:A3k03kHRJ6RJJPji0Aj
- TLSH T183657C17F6A802B5D067C1B8C5D29A5AEA713842173087CF1399C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 972KB
- SHA256 675d17bc5e2d54b56781c3fe090df7905072481d47fe33c42135f29cebe42d4c
- MD5 a2d0a77c1948464a84d3f114e744a21d
- SHA1 3c8fe9be5d43108df69fa2406e599866529caa00
- SHA512 7727276bc57fd55a2e08c4ce125007847cce9ac1acfd70a1b1e0d868ef941c46f6900f66ab49cd03bac16538ab191723e0cc3eaf637d48b15bdca1d10bdd38f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsiLa:A3k03kHRJ6RJ
- TLSH T1BE25AD17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe$
- Size 981KB
- SHA256 cb116e42ce35cf48de3a64dfdbba90e3e279bdff03f927fce3d95649095067df
- MD5 597c26cfc19de1fdf498f7053834109d
- SHA1 3d6149eb504e748cffd7b01e7effbede432adecb
- SHA512 45964f2521355201b19b2b29b859a315173ae7a7b1bfa849a52a55f624c4987c9f44ad68f364ee3313ef1710dee5d9dbd4ad9632fbc524cb941d7baa0402973b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsi2+:A3k03kHRJ6RJn
- TLSH T1F4259D17F79900E8D10AC1789A968A22FB757C56177093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe
- Size 1.4MB
- SHA256 a40251d39776811160e9950405ef190b3db50d3b0bacfe3bfdef5c8312bd3dda
- MD5 600f7bb6f68363f675ca65cdf8c6e1c5
- SHA1 efd767d47d5477e2a4208ebcd8db846b37a38881
- SHA512 75d5f147aeb94f739b583064a242cf914b2272c525c286e5aafdc77e5575742f0953f5a3575950d2976a8c36a53815f63f7a90395ed12a9fb1e10837e93afbd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsi7i6:A3k03kHRJ6RJLi6
- TLSH T127653983AB469CB5F14D84349591823DA6777E2D07E356CB234E7E0A5F367C82AF8318
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe$
- Size 1.4MB
- SHA256 dc8c1f71d66172eaf4dfb8362d0de74775621381d9973b4963dccf287e00920f
- MD5 f0c8ebf6062689d5487cf025d38804de
- SHA1 9bfbe26add679e4bad1a58e51c1261fb5e92ee13
- SHA512 b0f2eed3fa1fb2fe86b5a9c1a4349c369571d7e70511458315df110e65085bca88c52fffae44f69257c4a41fceb13493766744479d76119d5f5a8096c9d42df1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQsivBOkUhMXcBwcy0G:A3k03kHRJ6RJZUasqci
- TLSH T1C065CE23F79400BAC1968171E9958631FF39B9192B2082EF5358CA192F767D0BFBB351
- MD5 SHA1 SHA512 SSDEEP TLSH