Analysis
- max time kernel
112s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 19:02
Behavioral task
behavioral1
Sample
2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260519-xpxepadx5q
- SHA256 38a7bd69172c8f045e5ffc5024fc5acc09f93b5aba02e3a49aa337a6832d666b
- MD5 811e01b91e7fcd92066b33fe9387dc5e
- SHA1 6221ac9cb6f07147f803b25b53a52bdf03612b1f
- SHA512 c8446320d6d7c5b4a9a714eb8c9bd10c0b9725ce49587090d002539b3044471373284d3c2430d6929d06d7432df29df6346a1a6610b2932aff874e66d31a6dca
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQJbeYTqMi8CtBd2QHCHmTBW5:A3k03kD4U2v+1qJtb2I
- TLSH T1E8758D26F7648271D023C075CBD6AA66FAB634924B3096CB1388D72C6F377D1D63A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/6048-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233ae-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5160-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/6048-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5160-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233b6-137.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024608-1437.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002462d-1951.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00020000000233ae-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x00020000000233b6-137.dat aspack_v212_v242 behavioral1/files/0x0008000000024608-1437.dat aspack_v212_v242 behavioral1/files/0x000700000002462d-1951.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5160 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6048 2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5160 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_811e01b91e7fcd92066b33fe9387dc5e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6048
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 38a7bd69172c8f045e5ffc5024fc5acc09f93b5aba02e3a49aa337a6832d666b
- MD5 811e01b91e7fcd92066b33fe9387dc5e
- SHA1 6221ac9cb6f07147f803b25b53a52bdf03612b1f
- SHA512 c8446320d6d7c5b4a9a714eb8c9bd10c0b9725ce49587090d002539b3044471373284d3c2430d6929d06d7432df29df6346a1a6610b2932aff874e66d31a6dca
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQJbeYTqMi8CtBd2QHCHmTBW5:A3k03kD4U2v+1qJtb2I
- TLSH T1E8758D26F7648271D023C075CBD6AA66FAB634924B3096CB1388D72C6F377D1D63A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 1.5MB
- SHA256 00bb5bfa329db22fbade10a1075daf390b8af6cc7e9191a8034185c29f25eb5e
- MD5 935753a1de4608794d42ed7d9d0e51fb
- SHA1 b6d6fea31cb375a6057e78a8d3dc3457d560a5fe
- SHA512 c1caeacfa0d5ba60ef8116dbaaeefea2c60c2f06cfa84de6d1f19f0e830b0dee48e96d39e9b0434379738e0fcce8e52d0b27b3e40af780e481753e242d8dddd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQJbeYTqMi8CtBd2QHCHmTBW5pP:A3k03kD4U2v+1qJtb2Is
- TLSH T177758D26F7648271D023C075CBD6AA66FAB634920B3096CB1388D72C6F377D1D63A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe
- Size 1.6MB
- SHA256 1d44f9727c780b18889e51415d6a78bc87672bbb8c24f1c33fcdea724d6d1810
- MD5 ca1f3aee3c3a05f832900140088ebab5
- SHA1 93669e9808a1b2021e2f9abb92adc9fa8c93ef9d
- SHA512 49d38c98d3f63b797ae0d85b656b27af050e7da496a0dd0f209d22d20c8bea0e6f71500435aee71d1e16802185d047d748edb796eb394ab615e0a6aaa8fcda34
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQJbeYTqMi8CtBd2QHCHmTBW5SGen:A3k03kD4U2v+1qJtb2IyI
- TLSH T168758D26F7A442B1D063C175CAD6AA66FBB634510B3096CB1388D72C6F337D1DA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 6eb873f14b6d0d15f8db1aa74251804e7479a1546db559a22f6741c97d8e0dbc
- MD5 7e6a6f95e5d2511dcc420f554535728c
- SHA1 5a024c4302c621b773376e5c866dc4a110581e34
- SHA512 7002174fb9db67b0b029937dc9ef6895a0ef16ff68a081e01d5452d93ae884e75f408d585c2a8d1e489fccf7cb79e4c58b5a35e949db9fcb362236012bc859de
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQJbeYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxe:A3k03kD4U2v+1qJtb2IQPji0Aj
- TLSH T110A56D26F6648371D073C079CAD6A69AFA7134821B308ACB1389D72C6F677D1D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.6MB
- SHA256 55662e6f998d0daa8d420d2bd52df144e05bbe2431fedc9ee8a921f47df14cfd
- MD5 519e7aca18bd94a69aeb39635a27a66f
- SHA1 775f4020cb232c29dfee35beeb10a5a16372c506
- SHA512 16da623fd3d233725115a2e7c37085bdf1f241acf32c7dcd8e82434274508dbd5bde7478415b4bdd9c52f4b63f53ea4fcbb1f4644278af0f667e68678d8a71bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQJbeYTqMi8CtBd2QHCHmTBW5sD:A3k03kD4U2v+1qJtb2It
- TLSH T1F9855A26F6644271D02FC075CBD6A656FA7738514BB096CB13C8D63C2F326C19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH