Analysis
- max time kernel
105s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 01:15
Behavioral task
behavioral1
Sample
2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 1.2MB
- Sample260523-bmax1sas2j
- SHA256 3357dd3f35a39e2fe2c477ea939b8554228e57dbbc2118033715cdd30285cdcc
- MD5 8c43c2f13cacd52167f8f9a51f98c2c7
- SHA1 48e3497525b35598afa3a9be2e8d77350df8996a
- SHA512 be73ab461f49e685a24aae1426851af161650eb8837e09ff85a2ad5276baabe9d1ccbb5782aa0cce2517a35106e4e2136fef577564769399b893bc4adf2c4fcb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEP9UD:A3k03kHRJsD
- TLSH T1DD452706E69400E8D15E8134CBA65A22F7777C2507E096CB13D4E63E2F726D0AEFA753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/1280-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1792-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b1-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1280-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1792-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022862-748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244f9-1608.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244b1-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x0002000000022862-748.dat aspack_v212_v242 behavioral1/files/0x00070000000244f9-1608.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1792 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1280 2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 1792 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_8c43c2f13cacd52167f8f9a51f98c2c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1280
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 3357dd3f35a39e2fe2c477ea939b8554228e57dbbc2118033715cdd30285cdcc
- MD5 8c43c2f13cacd52167f8f9a51f98c2c7
- SHA1 48e3497525b35598afa3a9be2e8d77350df8996a
- SHA512 be73ab461f49e685a24aae1426851af161650eb8837e09ff85a2ad5276baabe9d1ccbb5782aa0cce2517a35106e4e2136fef577564769399b893bc4adf2c4fcb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEP9UD:A3k03kHRJsD
- TLSH T1DD452706E69400E8D15E8134CBA65A22F7777C2507E096CB13D4E63E2F726D0AEFA753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.3MB
- SHA256 4224f403f5a007646766084883db9013b5703575fa3f4025d42519dd4e1e1c1b
- MD5 c4444087fd4d634a5d430a91a313de4f
- SHA1 15c2d6022fd30108c196b821cdcbfdab1efa0ab0
- SHA512 00c80babc2f6833bb67892a64d994103f6d691e65e57b73d118641b8a1496102465830508b31dc334fc258136f1888278240c9887aaabd124b172f14a9d08c85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEP9UxTjE:A3k03kHRJshw
- TLSH T1E9552706E69410E8D15E8134CBA68A12F7737C6107E096DB13D4E63E2F726D0AEFA753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 fa5e0f4318a85fe8c8feb9f93da989335176d09daadc8663b16489129121123d
- MD5 00d168c5349e0807e7d0f8d4ca8bf783
- SHA1 b4aab271fb6d6a13170db4f8997983b4bbc5d4bd
- SHA512 17b53f9facb1b27c77f768c4f964fdd9eb9ca9c73e4cb90129b4442c243e0d2e5e7b4a416e186bb2a35d7a423df060a490d93b0918f071e8aed97ec1e960f788
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEP9U/0Le5ji0hmxNrM:A3k03kHRJs/Pji0Aj
- TLSH T1FD853916E6A402A5D06EC178C7929656FA33385207F096CB13D4E63D2F336D19EFA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 1.7MB
- SHA256 212eacc709b437046d74f0dca043f3a28ae7fb651d753f72affa623f91daf7e6
- MD5 4c71c76dbbcfec3e90fb8b1d6cfd982b
- SHA1 f4cb8b380c811c111d0e99ba2a4cc09687751d7f
- SHA512 98be9b9d46bd7e8e1b0765fe9d079c07e74c8a2b15ac7f1c01d1ade29bcc3cd39e94fa56c09607795bb5039643c8192df3a6b7df100945ea6698e0cc37b9a779
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEP9U3UOlZ7q/c9:A3k03kHRJs3UOlk09
- TLSH T18B851716EA5450E4C16E8578C7968612F7737C2107E096CB63E4E23E1F326D0AEFAB53
- MD5 SHA1 SHA512 SSDEEP TLSH