Analysis
- max time kernel
106s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 13:23
Behavioral task
behavioral1
Sample
2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.8MB
- Sample260525-qmvpract5v
- SHA256 5357b22fbd5aaac75e96eabe5cde4cf3256f6d4c649674c22c212eddba313aa9
- MD5 e20a90d54ee3323875d933e4cbab818f
- SHA1 da736b1f9b9a0d96fad086516f7aa2b573361667
- SHA512 a592e582740db88a05cb3e9854db41159518ea90df96d8aeca402fe95a6756893b1b654210de78f6e1d763c729474abf7b77524ef7a0ec77afb97b44fcb5ca90
- SSDEEP 49152:A3k03kHRJP56r8pYqOqJtb2Ij56ru56r5qJtb2Ij56rbeW4SkZP4sz9MbsqJtb2e:A3k03kHRir86lJrbr5Jr7fkZcsg
- TLSH T13836D615F6688B61D07BC079C6D2969AFA333C415F308BCB0285EA6C3E376D59936723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/3480-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024684-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2892-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3480-52-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2892-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021d1c-1019.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022be6-1285.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024684-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021d1c-1019.dat aspack_v212_v242 behavioral1/files/0x0003000000022be6-1285.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2892 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3480 2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2892 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_e20a90d54ee3323875d933e4cbab818f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.8MB
- SHA256 5357b22fbd5aaac75e96eabe5cde4cf3256f6d4c649674c22c212eddba313aa9
- MD5 e20a90d54ee3323875d933e4cbab818f
- SHA1 da736b1f9b9a0d96fad086516f7aa2b573361667
- SHA512 a592e582740db88a05cb3e9854db41159518ea90df96d8aeca402fe95a6756893b1b654210de78f6e1d763c729474abf7b77524ef7a0ec77afb97b44fcb5ca90
- SSDEEP 49152:A3k03kHRJP56r8pYqOqJtb2Ij56ru56r5qJtb2Ij56rbeW4SkZP4sz9MbsqJtb2e:A3k03kHRir86lJrbr5Jr7fkZcsg
- TLSH T13836D615F6688B61D07BC079C6D2969AFA333C415F308BCB0285EA6C3E376D59936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
- Size 4.9MB
- SHA256 ec178c8d7c74fe9073c221dc3ad7d8a8b70b7049a1a0a400d7a16d11042cd615
- MD5 75cbb08ae8b3d6364f7f20686936b6ca
- SHA1 9b7e5cf38961855ada298f12d2cec91a3e480131
- SHA512 e066b89d9dd71f30ea6db3042a13af759721fcc7b6ceec4fffb3db030f70633ea5f7e8fb88546d939a43cf230a49403720212bbcaf8f5a95c501bc25aabb8a8a
- SSDEEP 49152:A3k03kHRJP56r8pYqOqJtb2Ij56ru56r5qJtb2Ij56rbeW4SkZP4sz9MbsqJtb21:A3k03kHRir86lJrbr5Jr7fkZcsqI
- TLSH T17436E615F6688B61D07BC079C6D2969AFA333C415F308BCB0285EA6C3E376D59936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.3MB
- SHA256 f737fbbad86473445ec4e84e579d66cc9bc38448d31a7cff69fa6b17f698036f
- MD5 1fa50efc1be67bde6d6203cdcd137401
- SHA1 dcd61b252d7a20416df6bf4545205d44a9516d56
- SHA512 be984d1a45c112da95b6ebed0339fe5c410057ce2c7bc5a8d1d6b04647b8b584e27133fa3148f14f0e4b1712a9da0f7fc3f3c0dfb13518f85a2ac6d453195c3a
- SSDEEP 49152:A3k03kHRJP56r8pYqOqJtb2Ij56ru56r5qJtb2Ij56rbeW4SkZP4sz9MbsqJtb2x:A3k03kHRir86lJrbr5Jr7fkZcsmjo
- TLSH T16C46D615F6688B61D07BC079C6D2969AFA333C415F308BCB0285EA6C3E376D59936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 4.8MB
- SHA256 cbfe4107887a3bb7b268c600a1382955621ff4eb366f67d91bc9bb215a2c6279
- MD5 c6d2d27d8dfc4ea9d26d8902f2c73b0f
- SHA1 1e0243da9248a469c846b5b93cc8bf1f01d86681
- SHA512 a29a59940ed6dddc27f8babcece99331b7d5b60f97e2d93a41643f1805ab7940eb2395afc57f16e5545e6009a4b881e1859e62dafdb04b76c07205555f2397ea
- SSDEEP 49152:A3k03kHRJP56r8pYqOqJtb2Ij56ru56r5qJtb2Ij56rbeW4SkZP4sz9MbsqJtb2X:A3k03kHRir86lJrbr5Jr7fkZcsN
- TLSH T1A136D615F6688B61D07BC079C6D2969AFA333C415F308BCB0285EA6C3E376D59936723
- MD5 SHA1 SHA512 SSDEEP TLSH