Analysis
- max time kernel
113s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 15:25
Behavioral task
behavioral1
Sample
2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.4MB
- Sample260525-stryjsfv7x
- SHA256 6fcdff9bec54dcb247cfeca9c35dd3c8ec2124259f1302732d2e17271f64fc3c
- MD5 dda755c19505bbc674edde5c1c622603
- SHA1 d2d5e90db954b5fcbdea60b254f56e3cfc1e12e8
- SHA512 faa01a81756e58b8dad64578779b30c1d60af80cf8f23159ce12cf0acae6f58df0a32448011b65c2e63288d089590eb6ee9a117e498b6d0c1a2410f3d69482f2
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0ya:A3k03kHRKfkZcBrO1lkNa
- TLSH T1A6C53A12B6B84B66E0B7C174C9E6A656FA723C525F3086CF03449B1C2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2476-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001c00000002b4c6-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1688-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b4cf-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2476-46-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1688-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000029213-1034.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000029d63-1266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a9d0-1548.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001c00000002b4c6-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x001900000002b4cf-39.dat aspack_v212_v242 behavioral2/files/0x0003000000029213-1034.dat aspack_v212_v242 behavioral2/files/0x0004000000029d63-1266.dat aspack_v212_v242 behavioral2/files/0x000200000002a9d0-1548.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1688 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2476 2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 1688 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_dda755c19505bbc674edde5c1c622603_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2476
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 6fcdff9bec54dcb247cfeca9c35dd3c8ec2124259f1302732d2e17271f64fc3c
- MD5 dda755c19505bbc674edde5c1c622603
- SHA1 d2d5e90db954b5fcbdea60b254f56e3cfc1e12e8
- SHA512 faa01a81756e58b8dad64578779b30c1d60af80cf8f23159ce12cf0acae6f58df0a32448011b65c2e63288d089590eb6ee9a117e498b6d0c1a2410f3d69482f2
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0ya:A3k03kHRKfkZcBrO1lkNa
- TLSH T1A6C53A12B6B84B66E0B7C174C9E6A656FA723C525F3086CF03449B1C2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 2.9MB
- SHA256 e1b1bc1a464fd153f9c6cbdf254c3cd587ed2d3285cbf43d9acee9f17ca727f6
- MD5 6a681965e5253e8380911a20f63029cd
- SHA1 b76d8d0ef41d3839d292f2ca4693fe4942e20905
- SHA512 0e8112c39c77b7dc723c8dceae6a1ef5eca63e54693939dfb5f24c4acb2426979794880a81c4c0b92529b670398a04bd364569a10f01d3cb258088e1b5872736
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0yITd9CHKyao:A3k03kHRKfkZcBrO1lkNuCqo
- TLSH T156D54A12F2F84766E0B7C174C9A6A656FA723C461F3086CF03549A1D2E33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 27d0ac3fbc169eee8fac8a645a2b64514a9eebb5d4ecc9a38a04f57c22cd1458
- MD5 4ddb39ea76cd2f017039a60b54f94a5c
- SHA1 ac1419fe7a474f2b0fd61eb85bf29c5eea3e921c
- SHA512 fa2cf8d237e31ad1424932455d6d128c021f048c1a0adf1e7bb0d69082b511d5494c7f85aa92d9ef1117f01f1e4845f741de958521e0adb46afac94b710ea1f4
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0yqPji0Aj:A3k03kHRKfkZcBrO1lkNgjo
- TLSH T1EBE53B16F6B84762E0B7C175C9E6A65AF9323C421F3086CF03459B2C2E27BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.4MB
- SHA256 ed3a5d4157f54f21ab6ca4a71aa1f839914334e059dfd5246ce9cab3409cdaa1
- MD5 85e252e1935a09efb4be532eae237095
- SHA1 e58aebddbc081fb100aef2c277e178fd38b23ec3
- SHA512 04913e2459708a01ff44b0ab78ef73cd068b210ef46255b1eb1d6c43e9d6c408a19196451ba5819c2ed7204a0eadca7cc3838fb39c9ec031b9a60227f03d5bd5
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0y:A3k03kHRKfkZcBrO1lkN
- TLSH T1C8C53A12B6B84B66E0B7C174C9E6A656FA323C525F3086CF03549B1C2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.4MB
- SHA256 478291a1aa7278f80365dcc1f0801a0de3beeb65c6303b414f0dd39b81dae300
- MD5 a49cdac2ec9e618bc18376ea0cf7ce9d
- SHA1 b8fa87bd830944fbef14bc1ae17cdad94e5b2ffa
- SHA512 cdaa3290f0e3097947b2835514a13077a67d269485aa8a207778595d9a17555052076631fc91e528ecbe8539cfc6f0b4a7b902968dbf79e82c5ee55b56f9ea81
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0yb:A3k03kHRKfkZcBrO1lkNb
- TLSH T129C53A12B6B84B62E0B7C174C9E6A656FA323C525F3086CF03549B1D2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.5MB
- SHA256 fb5e173e9acfc20454794f1b44c0543f572fe9d6565f3a25991ff4d89595d130
- MD5 96577ae549f279b4c57552ca7db3cac8
- SHA1 70127f3e4fa27c938f9d787293ca3a02d9a8d87d
- SHA512 c41bd50760910ee050d23855ec2b5ffcf2fc28faebda090d77f7b976288681b8f3bfdca087aebb3cc6243eaf6e9aed8b6b28e84bc123c06fb84e988c5392ded6
- SSDEEP 49152:A3k03kHRJkeW4SkZP4sz9MbE56rO1lkWu0yK:A3k03kHRKfkZcBrO1lkNK
- TLSH T1F0C53A12F6B84762E1B78174C9E6AA56F9323C411F3086DF0354AB2D2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH