Analysis
- max time kernel
133s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:58
Behavioral task
behavioral1
Sample
2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 6.9MB
- Sample260629-ejg4psdy4p
- SHA256 7d9f65ef405e5cace5183750743f34e18ce67000e1fda7666727a83127c44bf3
- MD5 ad791f54e855fa2e28bca881243e915f
- SHA1 c7328e8234377712ac78d8046a00f55784139562
- SHA512 cdce2513d0885197cbcef33f2ae29cb55421d90bb259fc3fe75a9a7f57eeea01986d35251a0b6785b5d02f741ac92d6180c7479e232e6d5ff3e4680fff4aa12e
- SSDEEP 98304:A3k03kHR26FfkZc+fkZcNfkZcNfkZckJr+frZi:A3k03kHM6hPoPpPpPk9+jc
- TLSH T16D761916F6788B32E07BC079C5D2A659F93338454B718ACB024AEB2C2F376D585B5336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/4368-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c695-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4368-9-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6268-10-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000016fe8-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac4e-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c93-1290.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c695-5.dat aspack_v212_v242 behavioral2/files/0x0003000000016fe8-13.dat aspack_v212_v242 behavioral2/files/0x000300000001ac4e-1180.dat aspack_v212_v242 behavioral2/files/0x0004000000019c93-1290.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6268 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe patcher.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4368 2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 6268 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad791f54e855fa2e28bca881243e915f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4368
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 6.9MB
- SHA256 7d9f65ef405e5cace5183750743f34e18ce67000e1fda7666727a83127c44bf3
- MD5 ad791f54e855fa2e28bca881243e915f
- SHA1 c7328e8234377712ac78d8046a00f55784139562
- SHA512 cdce2513d0885197cbcef33f2ae29cb55421d90bb259fc3fe75a9a7f57eeea01986d35251a0b6785b5d02f741ac92d6180c7479e232e6d5ff3e4680fff4aa12e
- SSDEEP 98304:A3k03kHR26FfkZc+fkZcNfkZcNfkZckJr+frZi:A3k03kHM6hPoPpPpPk9+jc
- TLSH T16D761916F6788B32E07BC079C5D2A659F93338454B718ACB024AEB2C2F376D585B5336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 7.4MB
- SHA256 1b3f52427632ede2bb8149363261837bd07568d4de708e2aa7f0375adc746a0d
- MD5 308f063bf8975719d793b92d08213a05
- SHA1 0d1c7ccdaaa5e25010c9e4588bd08d993743b8da
- SHA512 b5b4ab231f5f6cf9e9d82c5e79edeb0bbb41e165889e339863cc76f6bfbd839f9da19c1ccf2bed6ab9b437182abae4c0abf6528b4d6d5a5eedeeafca631fc312
- SSDEEP 98304:A3k03kHR26FfkZc+fkZcNfkZcNfkZckJr+frZizjo:A3k03kHM6hPoPpPpPk9+jcXo
- TLSH T1CE761A16F6788B32E077C0B9C5D2A659F93338454B718ACB024AEB2C2F376D585B5336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 6.9MB
- SHA256 f88eacf0042394c7929c51028bf6e98c5edcde7733dc539375d96af8f6aa8c50
- MD5 effd156f8339300b44880d967026c5bc
- SHA1 ba9645d2809dd29a6ebb8071f1a509354c4f49b1
- SHA512 5ee13542e35392e7de7f3f8c69e874bcb33ead7de287bd78ac0c820ac31a3d93246edf53d19fcf1e57a7722f0f4cb33fb72af6228291393694b58646ab6a0731
- SSDEEP 98304:A3k03kHR26FfkZc+fkZcNfkZcNfkZckJr+frZij:A3k03kHM6hPoPpPpPk9+jcj
- TLSH T15A761916F6788B32E07BC079C5D2A659F93338454B718ACB024AEB2C2F376D585B5336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 7.0MB
- SHA256 f6b8bd0a5d4d16c15648e0332611c31cee6d367f7feb82f946774892d8ba67fe
- MD5 c71a30744aac32bc93af55dc9470c618
- SHA1 473c833bc3fb144f226954a14b9adacaa9284a83
- SHA512 b0a5f03b1a164e8f82eda65a02f0103c3f7e6349b5a024721bc3528b6a11a2e0b41691d3d5135ab9a26b8e928dbefcd76e129f91329508e2759fcdc3a5dae327
- SSDEEP 98304:A3k03kHR26FfkZc+fkZcNfkZcNfkZckJr+frZil:A3k03kHM6hPoPpPpPk9+jcl
- TLSH T1C4760916F6788B32E0B7C079C5D2A659F9333C454B718ACB024AEB2C2F376D585B5326
- MD5 SHA1 SHA512 SSDEEP TLSH