Analysis
- max time kernel
84s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 11:05
Behavioral task
behavioral1
Sample
2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.0MB
- Sample260519-m6tp1sav51
- SHA256 78628f388be1b133f3a17dcf0b6b258fcbca8047fa888cc056b4e00ce9dbb574
- MD5 3c2437b9dc399f86469cfdedcbe4b0fd
- SHA1 aaeaff1a1244f0545ec6783e119ee80d14278250
- SHA512 f411ea38512ac0d58c5eb935377a92d521d6fb1bf655933f8b7f82b0f7d6907a7fa609b02c3401dc5da687e6781d268f1f5ea3a5d5d111257cf261bd765ed503
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraMD5TvinrmC:A3k03kHRJY56rX
- TLSH T191256A03A6980FA8D11FC1749A964A62EA777C125F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/4100-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024534-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4732-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4100-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4732-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e2-135.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021f67-822.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024534-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235e2-135.dat aspack_v212_v242 behavioral1/files/0x0002000000021f67-822.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4732 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4100 2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4732 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_3c2437b9dc399f86469cfdedcbe4b0fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4732
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.0MB
- SHA256 78628f388be1b133f3a17dcf0b6b258fcbca8047fa888cc056b4e00ce9dbb574
- MD5 3c2437b9dc399f86469cfdedcbe4b0fd
- SHA1 aaeaff1a1244f0545ec6783e119ee80d14278250
- SHA512 f411ea38512ac0d58c5eb935377a92d521d6fb1bf655933f8b7f82b0f7d6907a7fa609b02c3401dc5da687e6781d268f1f5ea3a5d5d111257cf261bd765ed503
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraMD5TvinrmC:A3k03kHRJY56rX
- TLSH T191256A03A6980FA8D11FC1749A964A62EA777C125F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 8d7d50f577e840dadbc0b66e00b00701c1bb346472ca362f222b7263acdcc123
- MD5 b5ccd6fe4e459e0c37793108c11ae568
- SHA1 9c38fb7f908ecebd20cb7482f73ee03cda933cb6
- SHA512 cd00d7dc5efedc3745df19e8eea8253359b070525514eb233e98e35a93f2f027a34d633fdf7c987b820b80943bbf3218bb6c30792923f14ea080e566560dd660
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraMD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJY56rTPji0Aj
- TLSH T132755B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.1MB
- SHA256 15e630bbf5b407820e8921efbdc551aaff388ee405e09c9454a2f612767badb1
- MD5 fbca08f32f678bf26777cdfa0423ce71
- SHA1 b74b91890f4df3c019db1e9e2cc8ac3d4de1c1cf
- SHA512 1eed07a5b0f24ee5e71e3e4c56f425e6e799319111dadbfcb53a80e3644fbb5ac10043f4d90b12da03ee83f4ee1451c849d500604edea2b7a5070c56144499fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraMD5TvinrmrD:A3k03kHRJY56rU
- TLSH T19B451606E6980AA8D11F8174C7954622F6737C125FE093CB13D4EE3D3F72690AAFA257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
- Size 1.4MB
- SHA256 c25d21547e8c470ccbe646bd182abf1b8213c6c41fd3cfbda9f0e6aa0f084554
- MD5 f764e830cc79819518abe0d6ec920e26
- SHA1 83a098bbe220b046a84cfa011250b95d298bd3ec
- SHA512 941584d383a6c290e700d69b87d4475ceda4b63c6be7bfedd3cac459590f87ede7ae829785a8ca91f6ccb3653b12a73171422969ac2d98e8b36541ec5b30966a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraMD5TvinrmIZuqZM9RfkX:A3k03kHRJY56rVZkk
- TLSH T16B655A07E7940AE4D15F81788AA68672F7737C551F2097CB1364EE1A3F33A90AE39352
- MD5 SHA1 SHA512 SSDEEP TLSH