Analysis
- max time kernel
113s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 03:52
Behavioral task
behavioral1
Sample
2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.2MB
- Sample260601-efb4aaes8l
- SHA256 8e92a584f64ead2353623b30667a9dc9d8c12414549c929595d9b02518f73250
- MD5 218d2d5f01b76f5e726e71c094635d9e
- SHA1 f14925001482fb530026b9fc12ae52e01fc346fd
- SHA512 3dfd5a1fafddfe0eebe31a2959d686dfffd999f9239a6b205304fc674bed92d82219ec99c9b48b61fa976e59b81481d3e3e8750a3e26c00a1592883938402ae6
- SSDEEP 49152:A3k03kHRJWqJtb2IjZPItx2apeapel0qJtb2IQPji0Aj:A3k03kHRcntUvl0Zjo
- TLSH T1C5F56C16F6A44375D077C0B9C5D2A65AFA3238421B308ACB1389E72D3F277D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2356-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b52f-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/692-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2356-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/692-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ab9-1374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001a60a-1528.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0011000000000673-2065.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b52f-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x0008000000027ab9-1374.dat aspack_v212_v242 behavioral2/files/0x002000000001a60a-1528.dat aspack_v212_v242 behavioral2/files/0x0011000000000673-2065.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 692 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2356 2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 692 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_218d2d5f01b76f5e726e71c094635d9e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2356
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 8e92a584f64ead2353623b30667a9dc9d8c12414549c929595d9b02518f73250
- MD5 218d2d5f01b76f5e726e71c094635d9e
- SHA1 f14925001482fb530026b9fc12ae52e01fc346fd
- SHA512 3dfd5a1fafddfe0eebe31a2959d686dfffd999f9239a6b205304fc674bed92d82219ec99c9b48b61fa976e59b81481d3e3e8750a3e26c00a1592883938402ae6
- SSDEEP 49152:A3k03kHRJWqJtb2IjZPItx2apeapel0qJtb2IQPji0Aj:A3k03kHRcntUvl0Zjo
- TLSH T1C5F56C16F6A44375D077C0B9C5D2A65AFA3238421B308ACB1389E72D3F277D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.9MB
- SHA256 ba682a1dd27a7020f6b786a32681328162b31f812fc2f593d9d9667090e7f3a1
- MD5 c5b1d53c270a79ca27b538335b32cb1f
- SHA1 03e58a161bdd3825cc93da414aa1d8a147dec6c5
- SHA512 f2ecbc033f1c443ec35b316d9a230f95dc5a4b76f4debc5a391ef6c3dd33ae3e248bf8f913bd760bb4b71577d530e200ddcdfbc4b631d669f58c73849219335d
- SSDEEP 49152:A3k03kHRJWqJtb2IjZPItx2apeapel0qJtb2IQPji0AjPVk0QGTvntQb:A3k03kHRcntUvl0ZjoCHaib
- TLSH T11E167C26F6A843B5E077C1B9C5D39657FA313842073096CB0399D72D2F67BE19A3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.7MB
- SHA256 586f861822131efcde8123638eb8101bc5f7eb48cf08b9a114538f80fd3075c8
- MD5 0f8bc6afb95d9800bba489acf7faed24
- SHA1 62e20cc735fb5afe6185b6af02c664dbdc541d45
- SHA512 890f568985ec5964ddd4bd8fe24d94a1204998001858f8c8a54331bcfc42b24320c791ec205779a21d82453459d0c20030e764e619516ea29394aa8f4165ebf5
- SSDEEP 49152:A3k03kHRJWqJtb2IjZPItx2apeapel0qJtb2IQPji0AjoTd9CHKyao:A3k03kHRcntUvl0ZjoKCqo
- TLSH T10D066C12F6A44375E077C1B9C5E29656EA723C421B308ACF1389A72D2F377D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 22096d279c4fb746974ab8bedcb952bc04586c4f708dfa14d27594e1a3c282fd
- MD5 bf9e7fb2c2f6ce9791fde117f9b1dcda
- SHA1 3939027e93c19dded27ca1a8c16b8d2ffac747d1
- SHA512 3ea7ba7745aba2451de13bec72200583c395f78994f3305141e782a3ac11b519a81bc7ff06edf2de79a3e938aba8df2bdba412baf759daa7347b0e7b6ee10ab6
- SSDEEP 49152:A3k03kHRJWqJtb2IjZPItx2apeapel0qJtb2IQPji0AjKPji0Aj:A3k03kHRcntUvl0Zjo0jo
- TLSH T1B4065C16F6A44375D073C0B9C5D2A65AEE7238821B308ACB1389D72C3F677D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 3.5MB
- SHA256 f10559946c84591fd0f40ff2da9d5c29a29d164d12fdd6eeea3c67fc89b9dac6
- MD5 30084d9358f7c820e45c2d7d9614c2b8
- SHA1 6e6e3ec10ebeaa87991cbd11c844291024bec30e
- SHA512 3abb5bc9220cab6cce995437143037a62653e5e9855ad3dd1f929756296fff7ea251d51be2795d4f599460a20ce5da563fd22c3c3a44d7f062852f2d8eeefb67
- SSDEEP 49152:A3k03kHRJWqJtb2IjZPItx2apeapel0qJtb2IQPji0AjYi2WH3:A3k03kHRcntUvl0ZjoMuX
- TLSH T108F56D22F6A44375D077C0B9C5D2A66AFA3138425B3086CB1389E72D3F677D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH