Analysis
- max time kernel
112s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 04:20
Behavioral task
behavioral1
Sample
2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1022KB
- Sample260522-eydd3ahs2v
- SHA256 cea04dc36dee3e761e3e599c424f42040527f425179befdf72caaa96f3d42bab
- MD5 8e982e48da8df314534b18f43a445712
- SHA1 f07090337d660abec4d0f1f73e4cea1830bbbf35
- SHA512 5a4f79d546e6b3699d19a9328eb88b10586f077d52981a979ae0ffa6f11f6d7dc32e7231032efdf70521952f5a8252864e43486f2da1409e40b5042afd4c78c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjiHD:A3k03kHRJARJ4
- TLSH T1CB253807E69800E8D15E8178C7968A22F7377C5507E092CB13D4D63E2F62AD0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4160-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002100000002b301-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4160-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2524-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000000eeac-1294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e9-1632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002d00000000eeac-1646.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0010000000000673-2067.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x002100000002b301-7.dat aspack_v212_v242 behavioral2/files/0x000300000000eeac-1294.dat aspack_v212_v242 behavioral2/files/0x000200000002a8e9-1632.dat aspack_v212_v242 behavioral2/files/0x002d00000000eeac-1646.dat aspack_v212_v242 behavioral2/files/0x0010000000000673-2067.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2524 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4160 2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2524 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_8e982e48da8df314534b18f43a445712_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4160
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1022KB
- SHA256 cea04dc36dee3e761e3e599c424f42040527f425179befdf72caaa96f3d42bab
- MD5 8e982e48da8df314534b18f43a445712
- SHA1 f07090337d660abec4d0f1f73e4cea1830bbbf35
- SHA512 5a4f79d546e6b3699d19a9328eb88b10586f077d52981a979ae0ffa6f11f6d7dc32e7231032efdf70521952f5a8252864e43486f2da1409e40b5042afd4c78c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjiHD:A3k03kHRJARJ4
- TLSH T1CB253807E69800E8D15E8178C7968A22F7377C5507E092CB13D4D63E2F62AD0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.5MB
- SHA256 eb60e99d2e0c1d6010fed09011cf1a2ff674d5e31b6bfb80899bb00d6b73dfe4
- MD5 f22afcef812c17eb316b11c152063219
- SHA1 ec3b3eccd0372a4c18ca4394c0331956e9e3107e
- SHA512 f21cab01267c7049ced1ea82b89800c6dd43a167eea5f1942ea943d7956184fdde9328d931496013c6fd67af9ba0986998f6e8ab08d18dd45c7d50c6aae54c24
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjiHLUr2d29dBrtpDiI:A3k03kHRJARJUUidGl
- TLSH T1D5754906E69801E8D05E8174CB968612FA77785607E0A6DF13D4D23E2F72BD06EFA713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 1.1MB
- SHA256 b6fcc5f9e34697a8b4bd66cdfc8c7f6bc0b91a13959ffc64b31b6885b9486b96
- MD5 68e6699519f72bbb68a82f2211183376
- SHA1 727dca08a8ccc0d7b9bb6a8270c4acad5bae02a1
- SHA512 705d9c57e044701c25ee905ef8d787d58c440a41e26a3502aff4442d3278f5f8cffe6e3a61ae19c3d5eb42553954c3a8e75e1b0cba8a385878ee24e2e9d40df6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjiHxTjE:A3k03kHRJARJWw
- TLSH T13D453807E29800E8D15E8178C7968A22F737786507E097DB13D4D63E2F62AD0AEF9753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 1.1MB
- SHA256 92e2519e8641cce2b6620e1dbe08375e6acb45cd52ff4ee06d6a34fdee475caa
- MD5 b4dc686602b753cfbfa468904cdfee7d
- SHA1 11831a8569c140190753464e462a488e1af941f4
- SHA512 ac93302714e9753a42f9fc60a46d25c3b888cc2cf30c2eb3ec9bc9cc4ce38b0ac45f1a2074439f60a7d6e37726d3a3074400dd4f784438ff240b91e4a8ac3c86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjiHbF:A3k03kHRJARJw
- TLSH T1AD353806E29901A8C15E8134CB968A12F6377D9107E096EB13D4F63E2F727D0AEF9753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 1.2MB
- SHA256 9c19f58e9616021db7ff150c516b2a15a8eac84eb457fd7aaeb1090141928087
- MD5 52200068ea5cfe4ed9d925d7fe83bcd1
- SHA1 212b7b167d961b88f8ce3fef14dc4313a1eb1671
- SHA512 69b2b0a0271ec6188220b7e93e66f2aa8de770ee16e33ab3121a045d08b2f05e7a2b03d3f49816bcf10c658ff05c303ee71e785c5601a9d6313f7ba0d2a84ba1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjiHbV+PAk2hMH3:A3k03kHRJARJqi2WH3
- TLSH T102555A22E69800A9D15E8134CB959626F7377C5207E192CB13D4E63E2F72BD09EFA353
- MD5 SHA1 SHA512 SSDEEP TLSH