Analysis
- max time kernel
94s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 04:30
Behavioral task
behavioral1
Sample
2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260522-e4yxyset7n
- SHA256 811c19f0051ba3f6074676878403ef7a903632f9f8d2b5bf93817e1f06c6a3be
- MD5 9aa695e3d9cab074b061f4a8a495237e
- SHA1 d7a76d17a5ea398989b1bd472598d343da7624d3
- SHA512 190b0afa182cddc042de4495df4240e11c1b335cfb987d8f9f9f8fe90178b702c779ccdf906721852ee5a684a3ce141daa268957e33c2d27bbf55530453eb821
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduERaouZe0p4Ek4niOkl/A04szE87JKa:A3k03kHRJjeW4SkZP4sz9Mb
- TLSH T1B3854C16F6784363D0B3C0B9C5D6AA5AFE32344657308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2248-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b50f-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2248-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4420-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x009f0000000272e6-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e5-1622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1967.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b50f-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-11.dat aspack_v212_v242 behavioral2/files/0x009f0000000272e6-1137.dat aspack_v212_v242 behavioral2/files/0x000200000002a8e5-1622.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1967.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4420 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2248 2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4420 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_9aa695e3d9cab074b061f4a8a495237e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2248
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 811c19f0051ba3f6074676878403ef7a903632f9f8d2b5bf93817e1f06c6a3be
- MD5 9aa695e3d9cab074b061f4a8a495237e
- SHA1 d7a76d17a5ea398989b1bd472598d343da7624d3
- SHA512 190b0afa182cddc042de4495df4240e11c1b335cfb987d8f9f9f8fe90178b702c779ccdf906721852ee5a684a3ce141daa268957e33c2d27bbf55530453eb821
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduERaouZe0p4Ek4niOkl/A04szE87JKa:A3k03kHRJjeW4SkZP4sz9Mb
- TLSH T1B3854C16F6784363D0B3C0B9C5D6AA5AFE32344657308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$
- Size 1.8MB
- SHA256 0b754c07808ee2c0ef2c8c17c4f61109d9eefcb7a13e8d7a9b6f3018005bc6f1
- MD5 2eecfe8e52b51d146820a302c1704d1c
- SHA1 2589ccea96ee6a2ffda67617e990af1286fdcba3
- SHA512 15365b06a710cf2ca506f24f05b7754e6ff50b888e75762a20c1f49f2c51d05e20c5837dbe4e2dd7f6c4f4f54f13667a1041721ec1116a3bd129dfea6c0d5358
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduERaouZe0p4Ek4niOkl/A04szE87JKI:A3k03kHRJjeW4SkZP4sz9Mbjw
- TLSH T1DA955C16F6B84363D0B3C0B9C5D6AA5AFE32344557308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 355ba8f43474075e6f08c4d7f856112d2b90abbe3a6568a91b977802ab03012f
- MD5 ca87ef2975bef61be066a9fd00964358
- SHA1 24e5eabbd806b82bca1ddb6ed489746047665d73
- SHA512 e567728b24b754576094ce93376fd21e7e25db84222161e0abd49137dbfc37bc5bb6ffda208b59484088a462b597ecb5aeebbaa5d75a437e1f8b5a844d6c27c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduERaouZe0p4Ek4niOkl/A04szE87JKh:A3k03kHRJjeW4SkZP4sz9MbBPji0Aj
- TLSH T1BDB53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$
- Size 2.1MB
- SHA256 71e7275c87dd13a2c76423853d88a6e4594766d972611013a3c355ced069cc84
- MD5 84e0005b21a062b76997aaf8db16e3f6
- SHA1 6c062bc9395ca2e4910a63f1ebaa5e57a1ec8636
- SHA512 a5b054738932eed2886b97edb143bcf69d15da9ed436380c4eff2e2902c8b78fabd4762ce60cdb3a47795821c301600c55d84a5ef9a59d74d018804a2dd5d804
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduERaouZe0p4Ek4niOkl/A04szE87JK0:A3k03kHRJjeW4SkZP4sz9Mb41lkWu0ya
- TLSH T1A0A54A16F6F84366E0B3C175C9E6AA5AFA7238561B30C6CF1348931C1E23BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.1MB
- SHA256 76554b291ee54ae4cfc1ecbce4f27cb89dddf1ac6fd3309ce8aa1ede79cc2f0d
- MD5 566f8ac302bda503c49d48710827ef43
- SHA1 78c75172100581d696686bc1dad8fc3f88f02eb2
- SHA512 01538eb93ac62a67de1c50c4b3096ddaff7baa63514493dd8db794b88830b5f80ce985365a35705a67e99581eeeb2214b2c4229a5960542a7eeb944a4c1b50c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduERaouZe0p4Ek4niOkl/A04szE87JKy:A3k03kHRJjeW4SkZP4sz9MbgXpiMh
- TLSH T184A53A16F6B88272E0B3C175CAE6AA56FA7238425B3086CF1345971C1E337D1DA39736
- MD5 SHA1 SHA512 SSDEEP TLSH