Analysis
- max time kernel
109s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 11:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe
- Size 2.9MB
- Sample260510-m5dbmses2v
- SHA256 b0fd090c8cc9160ead34f368589ab05e67b94d1fce5126a245815c6a0a65c73a
- MD5 62c9b14c930c6e392473da2cb2f98c5f
- SHA1 f5b9e7efdd9029321767af9cee1cb6d7fb000f19
- SHA512 a202690f84e869f72a3fd7f50d3bb212f65100d1021a0a9821aa7195d4443a89bc9c02dee6c4b7afc6b175f00382185ad3e69c804202370efe90f77bfef353e0
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyaL:LeBpczwsb8YlbvbaNGYI3bCqL
- TLSH T12CE56B02B2905471D46286314565AA5A96BB7C20A6338E4F73D13ECFFFF27C18A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4560 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3196 2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe 4560 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_62c9b14c930c6e392473da2cb2f98c5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3196
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 b0fd090c8cc9160ead34f368589ab05e67b94d1fce5126a245815c6a0a65c73a
- MD5 62c9b14c930c6e392473da2cb2f98c5f
- SHA1 f5b9e7efdd9029321767af9cee1cb6d7fb000f19
- SHA512 a202690f84e869f72a3fd7f50d3bb212f65100d1021a0a9821aa7195d4443a89bc9c02dee6c4b7afc6b175f00382185ad3e69c804202370efe90f77bfef353e0
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyaL:LeBpczwsb8YlbvbaNGYI3bCqL
- TLSH T12CE56B02B2905471D46286314565AA5A96BB7C20A6338E4F73D13ECFFFF27C18A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.6MB
- SHA256 8263171912e1bc7cd40a05c6ed23c0e8813e72fed4ae34fbdd826d34fd279b71
- MD5 e88912f3e0a9136530f28fdfdffd114a
- SHA1 1d8079b0b387d26ff9a28904563a9d7e88fe0163
- SHA512 1235f893bd3c141d407c85ac176fe102e36ce9365cf651e68e73b9289a19f901ba517fbe7965ab9f008a25107f7aacd12b1e40cf9cc48c9523ce9a5540f091aa
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyaGVk0QGTvntQb:LeBpczwsb8YlbvbaNGYI3bCqDHaib
- TLSH T1CA067D11A29414B4D472C2314566AA5AE6777C2096338E8F23D17E8FFFF37C15A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 536815e4a18bbd9e19756fc991692af3dafd4c123dc9b5a323a4d3208da339b9
- MD5 0485a7e19846ec087846d193daf461ef
- SHA1 0933b20dd5a31ea57d31821358a304ae77257016
- SHA512 518b415b9a1ea1ae0d0790692d106fb4f5a5b85626a8de3e70b78cb324b3c6550087fbda69d8a8a0497d5dc6deb2096f6aa93eb61cf7c968970f68b5ea996cde
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKya3Pji0Aj:LeBpczwsb8YlbvbaNGYI3bCq/jo
- TLSH T1BFF56D11B2A04571D472C23185A1EA5E96777C2097328E8F63D17E9EFFB27C18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.0MB
- SHA256 cbbe12891cf96b0b7b94d455c1497abdd3af918810b903e859566510a2a274fe
- MD5 586ccd3f9e7d097190910c20c1f627fe
- SHA1 d2424c4fdfd9ba63e9141c11252d13167b3b8c71
- SHA512 552bf451b59937d140cc5e01e4b8d3cc6c3f7678d91d28337bd8ea5971365d0fd52b05062106b240716c020e2eeec28cd45e78249a1d0ca09d6eb7bd205a9ee5
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyap:LeBpczwsb8YlbvbaNGYI3bCqp
- TLSH T131E56B01B2905471D86286314865AA5A567B7D20A6338E8F73D13ECFFFF27C19A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.4MB
- SHA256 78f726d01ab42e3bdc7cb9b8c970adc41abf2d74f9fe6cf62f84eefdeefc612a
- MD5 e3e2c528c823f138f0ddbf6427a86ac5
- SHA1 e94773b646b21a1472eade021d0111dc3f53eef5
- SHA512 87cdb0e3eb999f052d2d54c086427e7649c490802273c13203a18a8a8bfe2d70bf136be19b08356a715d536c43e37232a00c4d4bbda6a23b2d7da6533a871276
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyaSXpiMh:LeBpczwsb8YlbvbaNGYI3bCqmpig
- TLSH T197F55A02B3E05431E47287315965AA59567B7C20AA328E4F63D13E8EFFB17C19A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe$
- Size 3.4MB
- SHA256 bcf74432a2ea57593b3410d4d2cd64bba0ae08e8bca74a1eb01cb9cf4f913a73
- MD5 7f9d1f7be7bcb4749dd6502961f5f073
- SHA1 d19defcb464bf461bbe526182f1b7834324214fb
- SHA512 9e65bca877de96ef0909cc39c240203016b8ce1ca29d3bb1a8c6fe63198bbd68218e06ef735279df049490b346653653c9fc23135346d1d4e50b0d9705783695
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyaRUasqc:LeBpczwsb8YlbvbaNGYI3bCqRPF
- TLSH T1A0F57C11B2A05031D46286319865EA595A7B7D20AA338E4F63D13E8FFFF17C19A36733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 3.2MB
- SHA256 55e90123da1c20ff9799c7b699402fa4fc27240ed7478cb06692f2f0f0f21454
- MD5 0de301f20ac59976c2ff535794026593
- SHA1 b49fbb8c69f60ac4250bb2928a58f0b979b293cb
- SHA512 b37cb93f73903f9502b25c843cd02fe48db6915028363e5adc9addd0cec9322478e2ec8e5cc94271b531e64e344d2c410d25aab3ef16f826a4b09d39a6156e2b
- SSDEEP 49152:LeODepLxKPzvoS7b8YlbvbaNFwYG93wg8cY/8Td9CHKyaTi2WH3:LeBpczwsb8YlbvbaNGYI3bCqTuX
- TLSH T173E56B11B2905471D462863149A5AA5A567B7C20A6338E8F73D13E8FFFF27C18A36733
- MD5 SHA1 SHA512 SSDEEP TLSH