Analysis
- max time kernel
94s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 12:45
Behavioral task
behavioral1
Sample
2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 3.6MB
- Sample260602-py8kbaex5l
- SHA256 9e060bd2c5759b055a723d5dea337478fb7c1d01136ca4ad49101485c0911ca1
- MD5 9b2147f3129fd772ffc119379b928cb1
- SHA1 a53acae2d02402b27380630777fe138fab4ded86
- SHA512 3da67e243bada751adc5b11a4db0b115a8563cfbc4924c35f120025c72da747edb2be8bbb3bbddbe01e10f8fd1db251b029a4f71421f240d4b9c0cf179211ff3
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZk:A3k03kHR+RgFfkZc+fkZcf
- TLSH T1B3062B16F6788362D0B3D0B9C5D6AA5AFA3238451B308ACB0345E72C2F377D59A39735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/3976-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b58b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5196-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3976-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5196-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a85-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8b8-1710.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00160000000004a7-2065.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b58b-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0008000000027a85-1373.dat aspack_v212_v242 behavioral2/files/0x000200000002a8b8-1710.dat aspack_v212_v242 behavioral2/files/0x00160000000004a7-2065.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5196 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3976 2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 5196 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_9b2147f3129fd772ffc119379b928cb1_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3976
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.6MB
- SHA256 9e060bd2c5759b055a723d5dea337478fb7c1d01136ca4ad49101485c0911ca1
- MD5 9b2147f3129fd772ffc119379b928cb1
- SHA1 a53acae2d02402b27380630777fe138fab4ded86
- SHA512 3da67e243bada751adc5b11a4db0b115a8563cfbc4924c35f120025c72da747edb2be8bbb3bbddbe01e10f8fd1db251b029a4f71421f240d4b9c0cf179211ff3
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZk:A3k03kHR+RgFfkZc+fkZcf
- TLSH T1B3062B16F6788362D0B3D0B9C5D6AA5AFA3238451B308ACB0345E72C2F377D59A39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 4.3MB
- SHA256 a77e9360b489fc0eabb49aca9b96e4f4a128471519b1d5897f3d6d5c7eae72de
- MD5 7673e5eedaee6e14d1ed5f161530b3e5
- SHA1 4074ac55c569eab84772426ee7d4b5518b7b561c
- SHA512 9eaca0e23fc8c17de44805f1778b79fc27b9068a83db3a59c30a935c5f8a42c8a170ef8cc39d1fb5c9447fa6d669107452b16c23f490f546b6fb6feb8d095672
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkQVk0QGTvntQb:A3k03kHR+RgFfkZc+fkZcfmHaib
- TLSH T16B264B16F6B84362D0B3C0B9C5D7AA5AFA32384617308ACB0355D72D2F377D19A3A725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe
- Size 4.1MB
- SHA256 7527041870da35b4bb1bffa385595269646aebb1148a77c6dff1a11083e4f42c
- MD5 8a7153fd13d4c6a6430de00af673bb01
- SHA1 dfce7e7f8864d69aae7d12809329291c85398545
- SHA512 675686514a113f0ea844f8230551ce6c04aa3e41a57a3d3d49bfb2ef8839dedd6ffbdc9ade49adce9edab3c1c42db1b090f1bcb3c4fe1ccb69cdc990cfe255bf
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZksT9t2:A3k03kHR+RgFfkZc+fkZcfV2
- TLSH T1E0163C16F6B88362D0B3C079C5D6AA59FA3238451B308ACB0345E72D2F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.1MB
- SHA256 53f0f0de8f272eaba38de0ecd92961ef90a29a1b98aba15fb2ce520ccc4016c7
- MD5 1d6f596b4b2af317599ce47ea33f4b54
- SHA1 c1c4f41b7aa2323b18cc4533c96e542fba307d17
- SHA512 550cecf1d628cf8063f6d92368eeebdd93a7eafef4b2cdca4c9592997a151db1be83500b11056c06e38ac53169df189f5facd6af25f85de4230ddff27a724e2e
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZk9Pji0Aj:A3k03kHR+RgFfkZc+fkZcfQjo
- TLSH T1BD162B16F6788372D0B3C0B9C5D6AA9AFA3238455B308ACB0345D72C2E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 3.9MB
- SHA256 58771480491f35449b0839c270a72e1ed83861809cde62424f214175f6afccc2
- MD5 b686adcd2e60e23d410873ca242ecdd0
- SHA1 ebebb464329cd86dffcc49aa61332ad412c28b21
- SHA512 bc0859d27fca787981f173e24336f84729733e9d7726c04aec3d8b19f7427999932f78d682d9053361e520ef7c3be6e53ed95e1069f69e66507be23438509f76
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbRZkNi2WH3:A3k03kHR+RgFfkZc+fkZcfouX
- TLSH T1C0163B16F6B88372D0B3C079C5D6AA69FA3238451B308ACB0345E72D2E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH