Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 15:04
Behavioral task
behavioral1
Sample
2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.0MB
- Sample260604-sfvsaahs5x
- SHA256 919f9c131155ff489d22e52f680f3f5551de555ec84fd8e3cc70ffb1dddeca0e
- MD5 2643ebae1ef8092aa13308ac05c699d4
- SHA1 7b4eb0cf6a298de7bb61d68b371a57b529c04db7
- SHA512 c5dbd970368a40fcb0ce5f6519e27d3e1de0bb6cb79d9d324da377efd54be8c56dad813190e540de7ae086df3201fb7bbc1a4e47bf40a7f6be87ab268d1bc591
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+weW4SkZP4sz9Mb:A3k03kHR2W/h1+cfkZc
- TLSH T164E51916F6788362D073C0B9C5D2AA9AFA3234465B308ACB1349D72C2F277D5D63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4576-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000002af72-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6048-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4576-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6048-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ea0-1248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a85-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e8-1636.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000002af72-6.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028ea0-1248.dat aspack_v212_v242 behavioral2/files/0x0008000000027a85-1378.dat aspack_v212_v242 behavioral2/files/0x000200000002a8e8-1636.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6048 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4576 2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 6048 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_2643ebae1ef8092aa13308ac05c699d4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4576
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 919f9c131155ff489d22e52f680f3f5551de555ec84fd8e3cc70ffb1dddeca0e
- MD5 2643ebae1ef8092aa13308ac05c699d4
- SHA1 7b4eb0cf6a298de7bb61d68b371a57b529c04db7
- SHA512 c5dbd970368a40fcb0ce5f6519e27d3e1de0bb6cb79d9d324da377efd54be8c56dad813190e540de7ae086df3201fb7bbc1a4e47bf40a7f6be87ab268d1bc591
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+weW4SkZP4sz9Mb:A3k03kHR2W/h1+cfkZc
- TLSH T164E51916F6788362D073C0B9C5D2AA9AFA3234465B308ACB1349D72C2F277D5D63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.7MB
- SHA256 f32a28e4fe718b72b8bb7e415c8be72041fb11463d7e649b26168953e97dc4ab
- MD5 6d06e0489455d058f29886c82da9bb4f
- SHA1 10c02cb70452ff634c0a66580e1818662c9a4066
- SHA512 3328a94660f897e5d5905b4d61768601039941d7666d1881ec31aa2d168dcd5377e9fa3587359dbfaa906c07a5939f4e97d7429ea66d57d106a7e1fbe4a3363f
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+weW4SkZP4sz9MbMVk0QGTvntQb:A3k03kHR2W/h1+cfkZctHaib
- TLSH T1D9064B26F6B84366D0B6C1B9C5D3AA5AFA32344657308ACB0345C72C2F277D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 3.1MB
- SHA256 800efc4f61dbcd4a8d7d1687e4e2d568f15300fb330b8a907505aa94ccdb6908
- MD5 a93659b776e15f90227610a47e4583ea
- SHA1 1b3c01294bc696a81937e00f232d4b3de22eecc1
- SHA512 6c855e3b209882398e7197aee885979b589a8cd79b375816c442796cd7f21cd5d459e365251fc657e025663bd404fa3943a1484c95f7fc7ef608f6297b5b4e5b
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+weW4SkZP4sz9Mbjw:A3k03kHR2W/h1+cfkZcs
- TLSH T10FE51A16F6788362D073C0B9C5D2AA9AFA3234465B308ACB1345D72C2F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 4f2a2f89b77c97d5ee9c90bb58df56acd7503d291457cf7b0367bcc5c0df2dc4
- MD5 ef4f05c0292efb0edec06f296dc2577a
- SHA1 5cc2fc99f1502249a3de2482c7fc5788e0553f41
- SHA512 2f623aacc242589779399baccb1f58c8e25406b15861f310093630a2e668e8fd57e6cd74024d5325b3f04bf17ffc4ce3b71551b209d4306d8afdddea341aa643
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+weW4SkZP4sz9MbBPji0Aj:A3k03kHR2W/h1+cfkZcRjo
- TLSH T1AA061916F6788362D073C0B9C5D2AA9AFA3234465B308ACB1349D76C2F277D5D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 3.1MB
- SHA256 8386a5be945d9983debfe48ba612fdb7e2813e9b623f52c815bcf0cef133a482
- MD5 72ebf4b35c9c007ea421b5490b2bdfd2
- SHA1 c85eea1e45c55dfdead991eb19475f9e4b28a7d9
- SHA512 96d4da6a91d17cd3c15a1059be0f9ea27789e7b17755694608d53666b71782e305aa327413fafe9cbbf7ebe3502ba6d3996844293bef05bc1b5f6e5fa2cd61f5
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+weW4SkZP4sz9Mbj:A3k03kHR2W/h1+cfkZcj
- TLSH T147E52A16F6B88362D073C0B9C5D6AA5AFA3238425B308ACB1345E72C2E377D5D636735
- MD5 SHA1 SHA512 SSDEEP TLSH