Analysis
- max time kernel
120s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 16:03
Behavioral task
behavioral1
Sample
2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.7MB
- Sample260604-thpjqaa17m
- SHA256 8a421ce9150a64f09da9b3a4df1a1fb05a746cfec40e5496d9e31c30bafbe73c
- MD5 f369ad8784288d84278299ceb2a24e04
- SHA1 0b500b3a34f17b7701abe7d0e72b22165c902457
- SHA512 c1cf1d3c11c80a058a05e6cbc8eb92313ba4c1c295f957b74df1a6137c32a9a61e71c54b9989e298f3128f2693834fc307f39a3138200667f4d9f2c1b008d175
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0Aj:A3k03kHR2W/h1+qjo
- TLSH T190D53A26F6A48375D073C0B9C5D2AA9AEE3234425B308ACB1345D72C2F677D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1548-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4c3-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1416-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a34c-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1548-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1416-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0082000000028a24-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029dfc-1291.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ac5-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0012000000000673-2063.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4c3-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a34c-12.dat aspack_v212_v242 behavioral2/files/0x0082000000028a24-1022.dat aspack_v212_v242 behavioral2/files/0x0002000000029dfc-1291.dat aspack_v212_v242 behavioral2/files/0x0008000000027ac5-1376.dat aspack_v212_v242 behavioral2/files/0x0012000000000673-2063.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1416 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3C9C959A-F248-4B60-A580-F846F36C0A80}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1548 2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1416 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f369ad8784288d84278299ceb2a24e04_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1548
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1416
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 8a421ce9150a64f09da9b3a4df1a1fb05a746cfec40e5496d9e31c30bafbe73c
- MD5 f369ad8784288d84278299ceb2a24e04
- SHA1 0b500b3a34f17b7701abe7d0e72b22165c902457
- SHA512 c1cf1d3c11c80a058a05e6cbc8eb92313ba4c1c295f957b74df1a6137c32a9a61e71c54b9989e298f3128f2693834fc307f39a3138200667f4d9f2c1b008d175
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0Aj:A3k03kHR2W/h1+qjo
- TLSH T190D53A26F6A48375D073C0B9C5D2AA9AEE3234425B308ACB1345D72C2F677D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.4MB
- SHA256 08626e9f513850d88df7dda68788134d186cbb2448666567b208c3b4c3c9b1f1
- MD5 e4ef83d71f42b30cb88da1bbc8ddf5d3
- SHA1 665286cd5ac8357d43bd97ef6bed687b6276432d
- SHA512 e6d0299eb8acda59edd6c2095e5f91bb5b67f9ae05ad83e6608b3000ed9bd7069fead04e54420cc100b5c0516bdaf033e0f2da6883c03d015cf52fba3a3d2a12
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0AjPVk0QGTvntQb:A3k03kHR2W/h1+qjoCHaib
- TLSH T125F55B26F6B843A5D077C1B9C5D39A5AFA32344217308ACB0355C72D2F67BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 d526ab51dc7a96af4f2ab8723109bbee287082b578ac958977e37fba81452b5f
- MD5 9a48c70cfb9df419a69f5a16d3c92d24
- SHA1 94154b7f371b7c1c621cfc301f5df4a96ca9536e
- SHA512 d11c0c6d36cf2d4faec6ffa50058914a0032148fdbff6321be1b05aa402c631175ee536cfe80c737442a8ddee9e07f17c5463c67c034ebe9fcf01224d9da2615
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0AjKPji0Aj:A3k03kHR2W/h1+qjo0jo
- TLSH T101F53A26F6748371D073C0B9C5D2A69AEA3234425B308ACB1345D76C2F67BD6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.7MB
- SHA256 a0e3c125a1e5e5ad4c2ea9ce5df29a14768fb30266b2a2b301721aa8e0c54f98
- MD5 ad8acd5aac774220f5478ad491df98ad
- SHA1 cc97975b3c8e61b5de2b1b582e7602b17560727f
- SHA512 5af66a5f725993894ca6544ce6e6225ab1ecdd7fbe9b32861f3ecbc2c31d3d52e5299a614d2117c8d89bb4a7a682f2c3a08d200bffa3aad661cefa5500e8c9e6
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0Aj7:A3k03kHR2W/h1+qjoX
- TLSH T1B1D53A26F6A48375D073C0B9C5D2AA9AEE3234425B308ACB1345D72C2F677D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 2.8MB
- SHA256 fa214a3c8e2b8af59308e0a6c826ca3ec2429e3e85999f4311cbe0fbea57090d
- MD5 08ece2a0b1ebe1b257bd134181d927fa
- SHA1 41006714afc2bd3a6b7d6861c40ab9643e43594b
- SHA512 6791f5218d193bc9e539d96c8db2fbcfe22243aeac8b5ca2949bf23e03bc7c12d6895abf26f386a85fb676937a3a9f2ce3a6e6c504ac7221d9c65d9a11743db7
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0Ajq:A3k03kHR2W/h1+qjo2
- TLSH T171D53A16F6A48375D073C079C9D2969AEA3238825B308ACB1345E72C2F777D5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 2.9MB
- SHA256 0246634c5c3d70e2847216980cd46f3ef6316ba1e27b54e4ccdf68a024961927
- MD5 fba569f0272cd080969b72a79636249a
- SHA1 fe7b5d3eba76e3fd91ec8f5b28a24c8fb2b8e017
- SHA512 b945e09028d7a8412617fb3fc0d1456094ebedae7b7c669b8f6e2456a6d33c582709862f68c2b14a74783e4daf381806c0da6e8d83ee85dfea04b4963b412bd7
- SSDEEP 49152:A3k03kHRJYqJtb2IkVO88hXl+8Pji0AjYi2WH3:A3k03kHR2W/h1+qjoMuX
- TLSH T132E54A26F6B48375D073C0B9C5D2A69AEA3234425B308ACB1345D72C2F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH