Analysis
- max time kernel
122s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 08:51
Behavioral task
behavioral1
Sample
2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260701-kscs8scs41
- SHA256 5ffc061731ec0b80559b7266b9feda784b1e52bbd9bd6b7c05188f104bb416cd
- MD5 98c723a82a7cadc753074e36379d0b18
- SHA1 4e75d458b2cad143d9092237b8eb5a088783cc3e
- SHA512 2e596244bb020ead4ee0347d9557b1e10671ca0c0b9aa95154b4718469daf9791c534a79cc1cc5387f725aeb4d59ffabfa6b6fa10f6652dd206d3a8996d7f3e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaaiKYK0MD5TvinrmC:A3k03kHRJm56rX
- TLSH T18C552706E6980AA4D11F8174D7964662F6737C125FE093CB13D4EE3D3F32680AAFA257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/700-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5bb-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5bc-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/700-39-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1212-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019974-548.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b65-682.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5bb-5.dat aspack_v212_v242 behavioral2/files/0x000d00000001c5bc-13.dat aspack_v212_v242 behavioral2/files/0x0003000000019974-548.dat aspack_v212_v242 behavioral2/files/0x0003000000019b65-682.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1212 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 700 2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1212 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_98c723a82a7cadc753074e36379d0b18_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:700
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 5ffc061731ec0b80559b7266b9feda784b1e52bbd9bd6b7c05188f104bb416cd
- MD5 98c723a82a7cadc753074e36379d0b18
- SHA1 4e75d458b2cad143d9092237b8eb5a088783cc3e
- SHA512 2e596244bb020ead4ee0347d9557b1e10671ca0c0b9aa95154b4718469daf9791c534a79cc1cc5387f725aeb4d59ffabfa6b6fa10f6652dd206d3a8996d7f3e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaaiKYK0MD5TvinrmC:A3k03kHRJm56rX
- TLSH T18C552706E6980AA4D11F8174D7964662F6737C125FE093CB13D4EE3D3F32680AAFA257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 39e8370b68712ad03b78eb6f785bd82c3ac178f2d9dc97a98e3fa048584d10a6
- MD5 e4deea942bb07eb769eac93f9ed19e36
- SHA1 c478438621cf719ab77e4293baf332a32518ef1f
- SHA512 409851c648f2238d45673b6d2d7555a62b51cd38c621ff196fdcb0e6671d96047d1181b1551c6c7a79ca88b2214fed75856b76f77c5eaa7a2500cf7cfa0658fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaaiKYK0MD5TvinrmC0Le5ji0hmxNw:A3k03kHRJm56rTPji0Aj
- TLSH T179953916E6640BA5D02FC174C7925656FA733C425FA087CB13D4EA3C3F226D19ABA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 1.3MB
- SHA256 d56b24bf403660edb80456a1b94f89d5fde991a84328601fc6f02316606c68a2
- MD5 698c359ef3d4b0365c4b8abfd1c70fa0
- SHA1 75425c290e17b2d1a14a95d1272a8f4f174ee974
- SHA512 416ab16a966f5952418d2ca5f595bdff55f62d45509bc2f7ff3eb6c24366efaac4b7809c86af179873cb0a0a926385899116631bc52823feae9b13529c934c1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaaiKYK0MD5Tvinrme/:A3k03kHRJm56rZ
- TLSH T1F8553706E6940AA4D11F8174D7964622F6737C125FE093CB13D4EE3D3F72680AAFA297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 1.3MB
- SHA256 007e399185893048331e9a32d5837a81a3cf6481ab005321ca34805fadcc5d23
- MD5 d7d4314d928c540e93a0c5cdce940531
- SHA1 e468c7c4e6f2c6c9c5890bd15b17d203d20c89ee
- SHA512 77bf99172cf6fea225ace28077a84e24742baf6b54692686e7b30e4ae8bfff2b1a448bf15a7d12df505b139b286db550d9efb978321b9a9632a002a063df162b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaaiKYK0MD5Tvinrmy5/:A3k03kHRJm56rT/
- TLSH T134553706E6940AA4D11F8174D7964622F6737C125FE093CB13D4EE3D3F72680AAFA297
- MD5 SHA1 SHA512 SSDEEP TLSH