00dac08f58b2594ef94d9e2386cdc8fcb4571a6311efdbfd380afac0a533e29d

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 778KB
Sample260505-n99fbae121
SHA256 00dac08f58b2594ef94d9e2386cdc8fcb4571a6311efdbfd380afac0a533e29d
MD5 57a18cf6b4faaa7a00d8e3d056c1e127
SHA1 9644a5ff199eee37a4cdd6c7870493b3b84fe004
SHA512 b133d0e7bdbdbb55e2f3ab2201334a4d728c38d5a19cbb40ad8903ac9a33eb090af9b9f9499b7ba97375619ca6a37cca7e7c20d6ea7d911bdefe17c9efbcdf8b
SSDEEP 24576:w4R5CIH/7o4R5CIH/70x20GU20GShhe8a9dsTcQ7Iwo0:wabH/MabH/WNTyV9dsTh7Iw
TLSH
T1CB053B22A7905096E4B3C57468B5821AAA357D7107609FDFB3C0770E1F32AD2BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4608	UpdatAuto.exe
1184	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\edge_BITS_4480_460308261\BITB6CA.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\edge_BITS_4416_1065688387\BIT9DA4.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4332	sc.exe
6140	sc.exe
768	sc.exe
4200	sc.exe
1596	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
4608	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4388	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	82
PID 4204 wrote to memory of 4608	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	84
PID 4608 wrote to memory of 5940	4608	UpdatAuto.exe	86
PID 4204 wrote to memory of 1184	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	88
PID 4204 wrote to memory of 536	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	89
PID 4204 wrote to memory of 3940	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	90
PID 4204 wrote to memory of 3988	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	91
PID 4204 wrote to memory of 3368	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	92
PID 4204 wrote to memory of 3376	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	93
PID 4204 wrote to memory of 4868	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	94
PID 4204 wrote to memory of 3680	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	95
PID 4204 wrote to memory of 4332	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	96
PID 4204 wrote to memory of 1596	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	98
PID 4204 wrote to memory of 4200	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	99
PID 4204 wrote to memory of 768	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	100
PID 4204 wrote to memory of 6140	4204	2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe	102
PID 536 wrote to memory of 2676	536	cmd.exe	113
PID 2676 wrote to memory of 3812	2676	net.exe	114
PID 3940 wrote to memory of 3112	3940	cmd.exe	115
PID 3376 wrote to memory of 3864	3376	cmd.exe	116
PID 3680 wrote to memory of 3976	3680	cmd.exe	117
PID 3112 wrote to memory of 2760	3112	net.exe	118
PID 3988 wrote to memory of 972	3988	cmd.exe	119
PID 4868 wrote to memory of 2776	4868	cmd.exe	120
PID 972 wrote to memory of 5428	972	net.exe	121
PID 2776 wrote to memory of 4940	2776	net.exe	122
PID 3864 wrote to memory of 1996	3864	net.exe	123
PID 3976 wrote to memory of 5236	3976	net.exe	124
PID 3368 wrote to memory of 4148	3368	cmd.exe	125
PID 4148 wrote to memory of 2704	4148	net.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4388
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- C:\Users\Admin\AppData\Local\Temp\2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry~4.exe
  2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry~4.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4332
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1596
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4200
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:768
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.3MB
SHA256 e378df9965f1d9679b6d22e154534ce1c2e3ef3009858663be88fe9ec1af2f87
MD5 c4b1a60d90f73cdd6f236b448af0e7b7
SHA1 8038fecefedad4d75d5f0157dcabfc7522f2f3ee
SHA512 9551935fa637b36216b8cd9bf9950ec3ce86c32b5f1c72a01135b92b21ae5756ee399a77c53b78f52d71aa30bfd5b0a199647f91c4d8e2c501c449cc613c08fd
SSDEEP 24576:w4R5CIH/784R5CIH/70x20GU20GShhe8a9dsTcQ7IwD0Le5ji0hmxNrM:wabH/4abH/WNTyV9dsTh7IwDPji0Aj
TLSH
T10F553A12F7A44265E073C1B5D8E1964AEA313DA107308ECB6385B75D2F33BE2A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.7MB
SHA256 dc25f63a7abd412b78b6a5b37cd4aaaccc3e93f0f4d22394746f3a06881a07e9
MD5 f86645b18eeac067a6efaeb8f51bad93
SHA1 2eb05b01da8ccaebcfb9752051591cea879ecb38
SHA512 7d646a148328e707f4f826f2677ceb70c590b5ce2fdd8e7333ed6d422ec6297dfedaa974c0660d7158112a7893d0c5959f22c9e0838ee0d5a3d2371f732d5bfa
SSDEEP 49152:wabH/4abH/WNTyV9dsTh7Iww/ezSC6vUzPvMHjy:A7IwUezSC6v2XMH
TLSH
T14A851A25B6788363D0B3C0B5C5E6A65AFE323C5107308ACB5346A75D2E337E2993573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.4MB
SHA256 a930179cfccea9f63374de96ec9a4e4f426d72795d853695d32ba393beff2b2d
MD5 d628c634d678b8ca7109a91105e865c5
SHA1 68ae2f641e630be47fbe87b1692cabfa58d2c0c8
SHA512 ea4745425fc2c6a5e8d0c5d58d79a973cb2cfda216a74a6a4edc6b16101ff34e776c3c53137e29221d37e2a5f4fd2da5a48bd09c0ad994ad9a61e4683568acb4
SSDEEP 24576:w4R5CIH/7x4R5CIH/70x20GU20GShhe8a9dsTcQ7IwDVbqPb88hv/l+7:wabH/FabH/WNTyV9dsTh7IwDVO88hXl+
TLSH
T125652B26B6A48265E073C175D4E2965AEE323C6107308ECB5385B71D2F33AD2EA35737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 778KB
SHA256 7ad88363bef4e567bc7df7d8e733dbf733fe6aa2dfebacfbb33e3d3813f75d9f
MD5 65042ee976d2eedbe9931acd72411457
SHA1 eefbeb6c0c6a4a79e57847d2b3c9d5357af606f5
SHA512 563254ced54d1738fa9b761bd9f0b16d3a51436808769a28990222a7653e4dfa76b30b96cdc915c3fc9d5848f8a706da6dc6d5724e04d800ae10ec20f85ef058
SSDEEP 24576:w4R5CIH/7o4R5CIH/70x20GU20GShhe8a9dsTcQ7IwNa:wabH/MabH/WNTyV9dsTh7Iw
TLSH
T184052B22A7905096E4B3C57468B5821AAA357D7107609FDFB3C0770E1F32AD2BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.8MB
SHA256 65384dfc8350c4237996921117d75036454b76bbad0f8fb088a09149496ae7df
MD5 3e4ccd4e290112a9ae6c64d9127cf21b
SHA1 81b884964f171d41bf53b9a1df008e8d7d9a20fc
SHA512 b61717e8681fe6b85669c0616801bacdc0d0ddc4305808aa994ed217e5bf50abcb9531577f01e2d7e5f6b578cdbf92426b28dbbdab949ec781b7f2c31ac3fbea
SSDEEP 49152:wabH/UabH/WNTyV9dsTh7IwOj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLj:M7Iw9QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T10B767C13F3A501E8E06ED974CF3952229B357C5A47B093EF269436E51A72ED07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.8MB
SHA256 aad551d30d647219e204d4d074e6a34d137ee5b5ef5fffafa5a4d9a0b45b97af
MD5 e0459280a718dabb3f33c56f3b66a916
SHA1 99982c60c18cb2b0c79c29d17c92d0414a24e848
SHA512 f4120cdb01a2a1297032397f2dda8bca70aa413a8f913a525cee810dc0e81e2c561faa5c9665e07dcb3340f1ec12b7826c0d8ae520f1714131aa5e4346464384
SSDEEP 49152:wabH/AabH/WNTyV9dsTh7IwOj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLj:o7Iw9QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T1AF767C13F3A501E8E06ED974CF3952229B357C5A47B093EF269436E51A72ED07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.5MB
SHA256 525a850ffeed620fbe95085b0fbfbd78ec4dd849dad13e1b716f978ab2d8caf4
MD5 f01af1df5c2f696007aedc138b68f577
SHA1 b347d610b981a0f84a5df78b7c05b0eece838f1e
SHA512 32ed2d6008337af894cac8ccf5e61a70d30b29eb0a2097a3fe93098ab251e029c0f6d7276c793dab1a94f66a421784f284a4968b424fd7e5d1b7883afed217ad
SSDEEP 49152:wabH/4abH/WNTyV9dsTh7IwG68Qg55nhoeWu7PNU3/Q:A7IwkthHRc/Q
TLSH
T117C53A33B2E20099D46ED176AF568721A6E17C718FA0D7DB8241730A1F72AD07A3971F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.2MB
SHA256 d2d49dc197f7cb6b0aaf5c4f52a73efca7d2ae6a571f79234cdee23d54ca8036
MD5 99e273b1098093645dde001e19d92c4b
SHA1 e7abb5e2978f3d760c56fb5c04751140a75e1f6e
SHA512 3dda430ef8a85812320dac51686566de5fcf488426f7810cd90aed4f89a205a5b2aa5a1f56b0990948d82deed85ed1a6532fca514d8b3285c76b85a4be8c63c7
SSDEEP 49152:wabH/4abH/WNTyV9dsTh7Iwq3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgn:A7Iw7y5112gYy5azzVvf69nLKnhZO
TLSH
T12C167C13F29900E9D06AC178975A8232EA72BC520B31AADF079077562F77EE16F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 2bacb8e8c68344d7fd9c9e91553dfa90bd857cbb86c6244bdedc73fffcdf420b
MD5 95b178a69ffa22d358e57f796103184d
SHA1 68411d23a7a5f301369fa470171795cf8d342c51
SHA512 e5aaa441a1cf9f42a2181d0cc6f9781436451f89113860062617932564a902c871e6b467864f883943e3e7cd6b9cbefd55cd449304f12840dbcd3bb8ccb61479
SSDEEP 49152:wabH/MabH/WNTyV9dsTh7IwjB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:E7IwVu6Jm0xd2d3
TLSH
T141E57C13F2D501E9D06AC574975A9222EA72BC650B30BADF179073462F77EE0AB3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.4MB
SHA256 d594c816f1010857eabe0e9741a71eafd7ce853d80a00cc7dd0b3949c558666a
MD5 cad177a5ce32d9ca7c2e19baac645618
SHA1 af544691bebbaaaad54870d2a634f16e38d8bd93
SHA512 3ffff54ea27904dd48c6f4a11a88ebf3a24d69744a9fe44ee26b3ebeea24503397d9d45114b4965024902960f9432cc975246bd7af83176da9687f517160470c
SSDEEP 49152:wabH/4abH/WNTyV9dsTh7Iwb1hpsNoJpF1A6GU44CwH7R4xu:A7IwbmifP5R7
TLSH
T1D6B57C13F3D400E9E06AC5749A658226EA72BC610B20ABDF1780774A1F77BE16F3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.6MB
SHA256 f537b4942bdc399114e4f2c778d73323fb59cdc167a939056a3647871283b6cd
MD5 9a1031f5d42e9efb468a6efbf2f5d044
SHA1 f9bee8cb778cabb0b41e3304e8ac9d604d6411d1
SHA512 db05ddd0497cd5516c2fed7f8240374c836d21f906659cc6f54c6c5002964fa41c59ffd0102439edb0058cf430a433b422ba88097a17d2897f50abb6e2ba6300
SSDEEP 49152:wabH/UabH/WNTyV9dsTh7IwmSuZQIY0Be2K8RVtOnks6NMHq6:M7Iwo5dKCi616
TLSH
T165C57D13B3D540E8E0BAD5749A758226EA727C610B30AADF178072591F37FE06F39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.8MB
SHA256 64a4d7757f0e8283ed09c053f25275f361840dc0d625a346c1059dc1f438db5c
MD5 23c479625ae27a3a2d5f45e4b8c00f6c
SHA1 c03cc89cc7dca0b004a0d76d3d80394cc7a9c3df
SHA512 5dacdb5744c7d6cafb87014ffab7052c0bcc06501afaa42f9ade3c2b831c24668ed421c5a0e75f9b45156a75c345f7fcbd52c38264c57d47c342864da069be8a
SSDEEP 49152:wabH/AabH/WNTyV9dsTh7IwDyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJy:o7IwKm7vj1BDlZG
TLSH
T198068C13F2D940D9D06AC07497568232EA32BC550B30AADF1790BB562F77BE06B3D726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.2MB
SHA256 f5c4a20104a42eed25e7535fb1b7e09b8f49059683aa584268b59ec81519c755
MD5 30095ea900aec220a0752a7b637386d8
SHA1 3d69495da4a09c9a210dd36253cc1b489a8209e4
SHA512 bfea08dbfae2cec01eca10c5e7e6ac240cb8e560b3b43b10ebace1659b3ab28f487b2fc35385acdfa7971522ff32ff04fecf294e0a6eaad78befbcd37f56d1c9
SSDEEP 49152:wabH/AabH/WNTyV9dsTh7IwUhtSn8EApI0fig1giDn0AP5w2:o7Iw1X2iwphX
TLSH
T104B58D13F7D400E9E07AC574DA668626EA727C610B20AADF1780774A1F37BE06F39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 787KB
SHA256 d2763849b279327172ca98cb1ee4b1c52b9cd6808b23102d8a0bce5605e0ce1e
MD5 1195d49afd2575d77271dfed773ede41
SHA1 3359b8f567730919a18c024cba5ca684812860c0
SHA512 369feadfd2f089b2b00dbca9255c6d69820fa4dc3cc205da7bdd46afb2f1890ecdd3a8d17bf3c7d1b30a559ed67f8d42f88c08b6dab2258351f4364744de9c7e
SSDEEP 24576:w4R5CIH/7Q4R5CIH/70x20GU20GShhe8a9dsTcQ7Iwy7:wabH/UabH/WNTyV9dsTh7IwY
TLSH
T19F052B22A7905096E4B3C57468B5821AAA357D7107609FDFB380770E1F32BD2BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 787KB
SHA256 674ee9d32eceb2427c5a18b1f10b33cfdab3a9eb747380bc9a9ee382815463ad
MD5 eb2b9379052b5e7cae6f24ceb42714ad
SHA1 362355fd893db033938a9b6ab357bb1c6fd5611b
SHA512 6a67a565f225d628f2c353b3197733ac3d3f8d5f0ded28bbb55e244cad4667c3469ece8afa10894519959664825acc798a0bd4109f049233d6e895a9d63b39e6
SSDEEP 24576:w4R5CIH/7Q4R5CIH/70x20GU20GShhe8a9dsTcQ7IwYx:wabH/UabH/WNTyV9dsTh7IwA
TLSH
T1F7052B22A7905096E4B3C57468B5821AAA357E7107609FDFB380770E1F32BD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 787KB
SHA256 f74b40f5c05cf2323af8c723045a47f934808730c04021dea0c0d3bef351a0b6
MD5 d4920adcd20f5b8a0575cbb7d6236aa1
SHA1 d3868422eda87ba70be43976763b68e460e80039
SHA512 1c686f4239dafdc84fba0b56b6a8d92188f82828a0ef8af95ecbfb763b10aa71fcecd28d2df59076a3222a452c54cb1ad8ed3700d828050fe4df45ea1a0d4940
SSDEEP 24576:w4R5CIH/7Q4R5CIH/70x20GU20GShhe8a9dsTcQ7Iw2s:wabH/UabH/WNTyV9dsTh7Iwr
TLSH
T189052B22A7905096E4B3C57468B5821AAA357D7107609FDFB380770E1F32BD2BDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 808KB
SHA256 dca5da750699c67119e814d47973f402a3f683dd567a33b44a3c14fb8c25a3eb
MD5 0937c02af1a2eeef9714b5ed386ddce8
SHA1 d29b14d4779a50cff8f58e86ed49b3274029fcc8
SHA512 16f84c927c530d7a9433a1c0de9eb2610f2737e8b12c49c31f98e8f3e52f4c5ba304efd748749f0c3dfb45a45a22ad79698b0e62da8d4bb9b0e6263ead7e8f0b
SSDEEP 24576:w4R5CIH/7g4R5CIH/70x20GU20GShhe8a9dsTcQ7IwS:wabH/EabH/WNTyV9dsTh7IwS
TLSH
T1A6053B22A7905096E4B3C574A8B5821AAA357D7107609FDFB380770E1F32BD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 787KB
SHA256 8df629145c4d878d8dcd2ce9db5c2a16e1bffe0764d939d5ea412bb83e1b2c5d
MD5 3e34c8808399e36f9260d9b7effdebb5
SHA1 cf276dfda474bb0633e5471808a23c5a5e40b451
SHA512 d6edeb6f8535a2051bbc97435e348ab0d046a9ed6dd3d424e99fcc84cf2e2edac4e7f1f77c4c6fb004e2f79ed9dcc53e45d2f2d8aa5c2ef5b4270e50912dcd18
SSDEEP 24576:w4R5CIH/7Q4R5CIH/70x20GU20GShhe8a9dsTcQ7IwtZ:wabH/UabH/WNTyV9dsTh7Iwv
TLSH
T190052B22A7905096E4B3C57468B5821AAA357D7107609FDFB380770E1F32BD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 907KB
SHA256 2133a8fb15680b9d51cd5c3da174a90a521aac080dc78484755cd4661d0ad790
MD5 0ab76a8921f2ab25138b828ce34e5fac
SHA1 872e8f4b67c3f066d8fae5380c07ed7bf6ddd2c5
SHA512 f06447a62f68d7845a48ccd06c464c2f304c098c4007f18b0000e20f76a00bca3729c118513cab8cf4d1bd60ff4c9f3aa78e73e91787172ec9af5ba3cb81666b
SSDEEP 24576:w4R5CIH/784R5CIH/70x20GU20GShhe8a9dsTcQ7IwYD:wabH/4abH/WNTyV9dsTh7IwE
TLSH
T11E15E711E7904095E47E8574EB658106BA377D7107E09ACBA3C0F63E1B32AD2ADF4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 820KB
SHA256 08c0b15682ccf7a004e9199655870bb7967591b59697ce5089591553b3c6e65c
MD5 53b1fdaf8c0501a9810b569178055a6e
SHA1 6e029c49b9aaac1e05c8daae84e22d76853a8131
SHA512 0625e2ccde7384bf2c4ac63481562dd0f35d4dfb3c6029e3c25bcfbfadc4e48e51450d02a8ff6d02fd9296bc8b768324f26c5e4f13b478102d0032f676cf9f29
SSDEEP 24576:w4R5CIH/7Q4R5CIH/70x20GU20GShhe8a9dsTcQ7Iw0:wabH/UabH/WNTyV9dsTh7Iw0
TLSH
T17F052A22A7905096E4B3C574A8B5821AAA357D7107609FDFB380770E1F32BD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 828KB
SHA256 e29550d52a208b59dc231e4804a3735c62189454eeb8ef2ad153c706433a804e
MD5 0b9d119d5cf402752bfc089af54cc454
SHA1 7ae963d2ce125e460b8d42ac2e52e1011edac2be
SHA512 4d0406232494fb4d15209823743ea5bf0dad04cdff53493b14cb2c926997397bbd8f28733ba3fb2e0fbfbd9a5f6e4d30f86d877b29d4bce59151c14a1c2dbfaf
SSDEEP 24576:w4R5CIH/7Q4R5CIH/70x20GU20GShhe8a9dsTcQ7IwAj:wabH/UabH/WNTyV9dsTh7IwAj
TLSH
T159053A62A7904096E4B3C574A8B5821AAA357D7107609FDFA3C0770E1F32BD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 824KB
SHA256 e8a92bc8af71397ff99b65c04e061a7bbfb4e2d5e871d0d6fdc6e15dc1cfd0aa
MD5 e874dffc4e02dff84e8478015ebb0e37
SHA1 cd856e0b0fcec9d3e8be9ac4d7b996a7b91191fa
SHA512 ce18c612270f3ff1c71d68f025470a5a3ae343e2bfeb3c0621bf72c8378a5c07cb1e45deb16fdb7f5a3c5a0a9f87593ed845ea1ce7396ee70f50b4b31a960048
SSDEEP 24576:w4R5CIH/7k4R5CIH/70x20GU20GShhe8a9dsTcQ7Iwyjv:wabH/AabH/WNTyV9dsTh7IwyD
TLSH
T1D5052A62A7904096E4B3C5B468B5821AAA357D7107609FDFB3C0760E1F32BD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry~4.exe
Size 14KB
SHA256 34173755fa78be5d3d2ed82260e2f64ab64558f8d0c5f3aab520d62797668e3e
MD5 4c8159f1c8e28d279f8824e3ddbe3ed4
SHA1 715f4f827e06806f6710f7dec2fb5ae77b57e244
SHA512 777285802dbf71966d7a099c84db80765821a72ecdbde503e0d0ed6159c0602d694b184f44d8c29c702715058d24af6c68ada6dc8086396d09ec657d7f7a7cce
SSDEEP 192:aplw/Q3AjmqdD5KOEBrXGWRVkdQ2l+8275N5y+NXNUoynP+yJihMrKbbP28d/o:MlgQ3655Kv1XtRV2QicXax+yJ+MObd
TLSH
T14962D502CBA454E1FBFB0631B9FA2A875AB6BD104894DE1E47B07FDD0C34680E566367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 764KB
SHA256 d830c2722304482b9b8b31b0a22c991a02b60f64988d0c2d0655470fac4c5951
MD5 ad8f8554a1af4ffe7c29f3499861717a
SHA1 bf02fdc5b954e5c92c9f984385e4510cd7f0f6a5
SHA512 6290a15bf48f39458912e142f9053e21f18ee3f35e593931715599e2c791bb1434c04607aa4b77af063315e56101a3da40a58fc8e3e62a8d3ef7cbb001a1f93f
SSDEEP 12288:w4Ryed8I7r/7mP4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7o4R5CIH/70x20GU20GShhe5
TLSH
T1F6F42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 335378d61433f59194828576e9dc23061d30731906cc24d18a065addc6e46463
MD5 dcaba6d4c0e6eb914b7302a960a271af
SHA1 97d2c247603276f808391028e11ae89fe626f638
SHA512 3976c997f2e7a44f72e40ee3e1a39ecaec81af7b32df303b761f30e82eeee8a08cc98de83d14f3c4cb51106f117502467a62fad3cfd01d58f71343ce5f74f537
SSDEEP 12288:w4Ryed8I7r/7m74Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/784R5CIH/70x20GU20GShhe5
TLSH
T1BFF42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 68e0032456b4edc9499a010ba76039319b2839a2113cac3a7785223f4b08f325
MD5 54d9425a1fc55083960cbd01ada231ab
SHA1 3ee313234d4b126f67425fad473baa59b52c7863
SHA512 5bffcedc7dd66ea6521a9c52f028687c40bbb05b4b6beb0d889b233f0cae1bf403c5978cd100a32d930919d8fe5ad10ba8b46627b69738956f2b0eeaff5bcaa4
SSDEEP 12288:w4Ryed8I7r/7mX4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7Q4R5CIH/70x20GU20GShhe5
TLSH
T1CBF42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 931fbabd69e9d9c49f42685888ca5d5d56b4328fd75e59fd320efb2557643cce
MD5 bab9c8c61962a24e26943b1510397343
SHA1 fa8798b0565c2cade362a11339fc3d2416685d44
SHA512 a4b63b6ff232643deeed7314e7cf58def187434cdcc9d4798b9c8533b50358042cf2dee4215d7cd4823f0f3b6443642f8ad31b03c9182053fa51ac6d7e8225cd
SSDEEP 12288:w4Ryed8I7r/7mj4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7k4R5CIH/70x20GU20GShhe5
TLSH
T196F42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 4b148348e7639b18ae3b649c36c3bd808847432cc4ddf1670f173732e4718dff
MD5 e463a716e4a7c120def88a8c1384576e
SHA1 24b263ec2a697675b624629791617f924e5e6bc5
SHA512 70f12ecf8739dc994accf446e3505a964a38402e07601ea468e7c1d4df35ad75d5dba76495532826fc442fe75954ac3165123c2d83db7f4bfca8cc8b18794a5a
SSDEEP 12288:w4Ryed8I7r/7mj4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7k4R5CIH/70x20GU20GShhe5
TLSH
T1A9F42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 dbebc4769ba06b630044db380befb0d12a01bac5f6c4bd0187def4fbaf5cc46f
MD5 096564295405317dfb5bb3228aec2ff6
SHA1 83fa329fdffaa72758d7d98ec3629daff163ddac
SHA512 af2c681bcfbf8120dd8295149e10dc5b9bfce73aa9ea157ba8b795d21e3014f8c580944dc5fcd5bda4e54e922943d952697890852355422978f936a4eec2f36e
SSDEEP 12288:w4Ryed8I7r/7mH4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7g4R5CIH/70x20GU20GShhe5
TLSH
T17DF42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 40bda37ebd604c3b9ca2940f798caf3f5a7ab3bc488c01fb7cf6efe3d350e737
MD5 024da23726120f6752f7cfd7ec963309
SHA1 1d016ef6573603cff5d40db82ad03fb77a114939
SHA512 e2c55242e3262c8f5c3919163a257ceb511131dccabd59e42818abeca4438b97f94b44b3dedfb016d02ec35debfb4e38461623cc496ccc39d1800774355a30ab
SSDEEP 12288:w4Ryed8I7r/7mC4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7h4R5CIH/70x20GU20GShhe5
TLSH
T11BF42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 71046c413c43a829780b4d1fb42f2c999803266aefdf9b48dbbbef7d54b06f38
MD5 6052abd7487d90589a8a238c641c8c95
SHA1 dbee6b5a71a8cab0af2e0c1ba4340edfa04ae7a2
SHA512 80e94a6bd9e486e9867f941bab93b83df28a9671ba9ce349b2530947d7493e6975804f24eb8e3b25722bd50eb0768f816d13ffdf140d764fba91ee71a68feedf
SSDEEP 12288:w4Ryed8I7r/7m74Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/784R5CIH/70x20GU20GShhe5
TLSH
T163F42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 764KB
SHA256 72f8f21ced462b38389ced7ac764790e3754ce3293563d970759f6a95b683ba8
MD5 9b7e930ae8f240ff52d4aa706143f7c6
SHA1 47183a9882668c3e45771e42b54c74bf97e0b86e
SHA512 89dbd44035563425690b83eac4457701778eb5c3279f260815dc97c5b9958bab8c7081c043f2491d87ddefa1ef6ea5be3a1676fa436567d0249cafa66b4f7475
SSDEEP 12288:w4Ryed8I7r/7my4Ryed8I7r/7mfVL1fh7NhO0ZUgL1fh7NhO0ZUvwAghhebcPaFh:w4R5CIH/7x4R5CIH/70x20GU20GShhe5
TLSH
T1D0F42B22A7905096E4B3C57468B5821AAA357E7107609FDFB3C0770E1F32AD2BD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-70-0x00000000008C0000-0x000000000097F000-memory.dmp

Download

memory/1184-68-0x00000000008C0000-0x000000000097F000-memory.dmp

Download

memory/4204-66-0x0000000000890000-0x000000000094F000-memory.dmp

Download

memory/4608-67-0x00000000007B0000-0x000000000086F000-memory.dmp

Download

memory/4608-111-0x00000000007B0000-0x000000000086F000-memory.dmp

Download

memory/4608-279-0x00000000007B0000-0x000000000086F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads