Analysis
- max time kernel
121s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 15:51
Behavioral task
behavioral1
Sample
2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 958KB
- Sample260819-tapjraxerb
- SHA256 61fe2d97d478ad8c69a146c25bea3c3070186f2df1399886c839eba2937e05d5
- MD5 2962e90ffcf4ec3f2fe944bd7fee86e3
- SHA1 8a73f6639e5d8e188d9ded894148645e2b5ea67f
- SHA512 d4adddeb77200f1d43b0a155705acd221644e979a038f3524f664134bcd7f1fddda028fa2646b4016c76ba15f499859a1db7540638a11b658f7c4e6ec548b2fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQgjp:A3k03kHRJ6RJC
- TLSH T1BC25AD17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5888-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c46a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5888-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4968-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb4-817.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-351.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb4-817.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4968 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5888 2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe 4968 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2962e90ffcf4ec3f2fe944bd7fee86e3_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5888
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 958KB
- SHA256 61fe2d97d478ad8c69a146c25bea3c3070186f2df1399886c839eba2937e05d5
- MD5 2962e90ffcf4ec3f2fe944bd7fee86e3
- SHA1 8a73f6639e5d8e188d9ded894148645e2b5ea67f
- SHA512 d4adddeb77200f1d43b0a155705acd221644e979a038f3524f664134bcd7f1fddda028fa2646b4016c76ba15f499859a1db7540638a11b658f7c4e6ec548b2fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQgjp:A3k03kHRJ6RJC
- TLSH T1BC25AD17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 3dc6e0db404a91b3ec4782af6840ce15c09d6bc30170a2fff6441a6337ebf79c
- MD5 1a8b289bf0355da3ed16f21279cce848
- SHA1 9f2cc5be66d5768ad82e3108ebe1dbda02c8de09
- SHA512 69dc340d39b6c5a4915e540e7df0756dd55e9a050fa9ee527087a740ce692b6663b1628863b0c6e9c9000b6a5a68bed0df59f21598a4849b8132370e759a7cb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQgjV0Le5ji0hmxNrM:A3k03kHRJ6RJCPji0Aj
- TLSH T181657C17F6A802B5D067C1B8C5D29A5AEA713842173087CF1399C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 972KB
- SHA256 c256d8db60d94d86b1aec0b7a7b647ab788c2c24679d1478a92b72336aeddf68
- MD5 f78fa7e52cbcadf1165236c9d0d86daa
- SHA1 b4bec2bbffb17f246211071f989e8713ff7790c7
- SHA512 8697a7a5c4bc9084fa92e0fde2a814a2c96fd321814c8c706b867a53b5026045d2ba863f2f66a253fdb908f6071778493d7d902c520cb5f55cc03a2369cda776
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQgj3a:A3k03kHRJ6RJ
- TLSH T1DE25AD13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$
- Size 981KB
- SHA256 de5e07169c95af086f37a49aa32051080143045de55b5292ea2c1e35b335da22
- MD5 af7fea89abc9c3f1d8c6330430800d61
- SHA1 a6cf020328f0cef53d6b569c09abc2cdb5e77ea3
- SHA512 f182021787245bea9e2ca95b133002f021e5961e054ad027c662d2cf23ca592ee34260bd53e43a40cf342a15682b696228bcdb474463c7d96d0cd08f3a62b49b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQgjG0:A3k03kHRJ6RJW
- TLSH T1A6259D17F79900E8D10AC1789A968A22FB757C56177093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 1.0MB
- SHA256 e97dfa639088ed002c9473cf37da60a7c981e4087157ebe8d76d6f737b2ff451
- MD5 8c2f3451d3e046d0ab27dc6b19f63278
- SHA1 5d23b2a5828f3625bc4857c657699f522f1edf80
- SHA512 7650ea35d9984e3a966f2d3052abf5ac771855b3e69fd53ca9aeedee59cc52aee70b712ad325c54f436ca26c427e9782627b93752ae0a4b1373fb9301528f361
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYCy6cMJlaQgj1F:A3k03kHRJ6RJS
- TLSH T1A2358D03E6D500E9D64A8134DE9A8A22FB35BD92072097EF2358B7262F727D07F39754
- MD5 SHA1 SHA512 SSDEEP TLSH