Analysis
- max time kernel
110s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 18:13
Behavioral task
behavioral1
Sample
2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260601-wtppzacv9z
- SHA256 11fcce93b4c98472e44441aac7d1f06d1227a39d858d5f2d964e4813e369747a
- MD5 d90c895def8de798c4206c5658fee1ab
- SHA1 bd88a961a2de70776e72bc9363dfb3e82e740215
- SHA512 ff84de6fbb8ba1caf8aa00a2fcc6dc2a5d86d30f6f82623fb70fa328ae824862dcf43a5a2c414ec05ff602c9aa7a6b5a87d79f4783f9a4069b3f6f80d9e28f37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHLY:A3k03kHRJ6pYq9Te
- TLSH T1FE856A13E6A441A5D163C074C9D69A66FA727C820B309BDF1358F7292F337D0AE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5480-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b55b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4016-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5480-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4016-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002787f-1282.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b574-1734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a876-1920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a0de-2068.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b55b-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a33d-12.dat aspack_v212_v242 behavioral2/files/0x000500000002787f-1282.dat aspack_v212_v242 behavioral2/files/0x001a00000002b574-1734.dat aspack_v212_v242 behavioral2/files/0x000300000002a876-1920.dat aspack_v212_v242 behavioral2/files/0x000200000002a0de-2068.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4016 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5480 2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4016 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_d90c895def8de798c4206c5658fee1ab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 11fcce93b4c98472e44441aac7d1f06d1227a39d858d5f2d964e4813e369747a
- MD5 d90c895def8de798c4206c5658fee1ab
- SHA1 bd88a961a2de70776e72bc9363dfb3e82e740215
- SHA512 ff84de6fbb8ba1caf8aa00a2fcc6dc2a5d86d30f6f82623fb70fa328ae824862dcf43a5a2c414ec05ff602c9aa7a6b5a87d79f4783f9a4069b3f6f80d9e28f37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHLY:A3k03kHRJ6pYq9Te
- TLSH T1FE856A13E6A441A5D163C074C9D69A66FA727C820B309BDF1358F7292F337D0AE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe
- Size 1.8MB
- SHA256 4f9f66f4e50bc67166a9256b192800363c6de8cf2424d2bf713ca827920d0927
- MD5 ff413f87e50cf2d6977c8264c2754bd0
- SHA1 1c7e3908298b085b780bcca1fd9f44440b19671e
- SHA512 9f7776c2279c02950ed737270696fd12d5e76488876b4ac3a321b289e3413b25713cd826eecaac61cf16afd853206498a9ecbca92aae9e7e54722a21c76f1c8b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHLX:A3k03kHRJ6pYq9Tegw
- TLSH T1C3956A02E6A401E5D163C174C9D69A66FB727C920B209BDF1358F7292F337D0AE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
- Size 1.8MB
- SHA256 609f0dbdfb0f8417579ce3668d9247fd5319f50ab52a5f16bf7fb0162d609ff5
- MD5 5d22e8556c24c941c95adeefcbc22300
- SHA1 3618c730a7dc89ebe8889d04ba7c3f08a7192443
- SHA512 ca27f31655cb4f4238c2fc8a28177185e268400607e941055326955616dcd8df096ace22bc4d3a7909836d564cc433295bc0e7d67f2e7bc6f60dbf09ed48af1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHLX:A3k03kHRJ6pYq9TeUI
- TLSH T1FD956A06E6A401E5D163C174C9D69A66FB327C920B209BDF1358F7292F337D0AE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 855a4587922f3007d39e86b84a23b6340da719af81c0037ce76d85ef60c01b89
- MD5 43043a0d10657a0895cbc41ea95a805e
- SHA1 cc42353b00cdd0dce25fa3ca46015b2c1cc025bb
- SHA512 11e38e5ab34d843335736e9fb22a75cc3b4800c5444ac782a135a91f9f143bd9064d795eef9cda21644713af494f52244b848a56842c092befa826984642fa5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHLY:A3k03kHRJ6pYq9TeiPji0Aj
- TLSH T164B55C16F6A442B5D063C075C9D2966AFA723C821B308ACF1355E7392F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.8MB
- SHA256 273f035ccb558ef06156ba2bb29d7f773dde6b88bbe46e363ddfb5bdef334791
- MD5 8c88beaad8ee6e65ed10346857fc0c0c
- SHA1 de29ca986ea3116365a05539aa41ae63c7ba3a6a
- SHA512 78c7506d22b42d440284f5298b4a3936ccc5b315c9ce20e4ae5efca96685333c9672d9ebd1eca7019282dc55f82d8bf36b0135f95fdedf40b09e140d8f8eb8b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHL0:A3k03kHRJ6pYq9Tey
- TLSH T169856B12E6A441A5D1A3C074CDD69A66FA317D820B309AEF1358F7392F337D0AE39761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
- Size 1.9MB
- SHA256 c5b964de64b64221c3dde5670a7b2af297b0fab815d2645a31d186ad0d29b015
- MD5 040b2d86566d495e61cb3c20e6550249
- SHA1 7b07c2fab32a25aa56ed5c2546193da043588667
- SHA512 a67d559eff8468af25808e7c4097188c33dc66f9574dc9bee1d26c60d6f44c41c7b6f2d4ab566dc04e4b989eb1dfb7141ef90a020765df6ee8572baf2fb1d2da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixqObaERais5jcAkSYqyEdyyCUq7lfHLp:A3k03kHRJ6pYq9Tewi2WH3
- TLSH T1E0957B12F6A401B6D163C174C9D6966AFA327C820B3086DF1358F7292F737D1AE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH