Analysis
- max time kernel
125s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 07:56
Behavioral task
behavioral1
Sample
2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 962KB
- Sample260702-jsrfyscw7q
- SHA256 f59f5b7a28e115f4951cced30e1052ebf1750df70e3f860e779713eb8da806a6
- MD5 15f1602f755de947d4861dd77fb5ac27
- SHA1 82cf999831fd9997ed0ebae9c18821819a244b7f
- SHA512 b674640e3b30807db85125208d80ae14f6875927d4534b38b2c861504bc65a4264082721b666367be46224c1b141acf452203ed3d3483e10456144e955680b70
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba5j:A3k03kHRJa
- TLSH T1F825AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4648-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001200000001c32f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4648-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1520-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-460.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bae-688.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002f000000019cb5-1281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000187b6-2023.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001200000001c32f-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b7-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-460.dat aspack_v212_v242 behavioral2/files/0x0003000000019bae-688.dat aspack_v212_v242 behavioral2/files/0x002f000000019cb5-1281.dat aspack_v212_v242 behavioral2/files/0x00030000000187b6-2023.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1520 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4648 2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1520 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_15f1602f755de947d4861dd77fb5ac27_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4648
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 962KB
- SHA256 f59f5b7a28e115f4951cced30e1052ebf1750df70e3f860e779713eb8da806a6
- MD5 15f1602f755de947d4861dd77fb5ac27
- SHA1 82cf999831fd9997ed0ebae9c18821819a244b7f
- SHA512 b674640e3b30807db85125208d80ae14f6875927d4534b38b2c861504bc65a4264082721b666367be46224c1b141acf452203ed3d3483e10456144e955680b70
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba5j:A3k03kHRJa
- TLSH T1F825AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 9b3150d25ce8b79e2b81abb16bc6521eeed08772d373143378a66b2f1372d9fa
- MD5 5cb32e05ec63dd34a32222a95646793d
- SHA1 350139dadb8c148ad4805854485fd10c294c415a
- SHA512 469da6c34448088aeda7fcae77c9b277e56451101b53a186e99e0f8f83d4267b6663d53380474208a281be68bdf46e7260d4dab8722dd4c30d1a9417a03b7325
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba5f0Le5ji0hmxNrM:A3k03kHRJqPji0Aj
- TLSH T176657C17F6A402B5D067C1B9C5E69A5AFA7138421B3086CF1398C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 985KB
- SHA256 43a68d51d6d8641dacfcfcb39905090d31f1606057ae4c7de719152ef1683df3
- MD5 b6a7d1f65b32408ece899ee427152ba9
- SHA1 a19e7110a4bd72f33fba0b4604506845dd4d73b6
- SHA512 7822ce819fe3245080360ddc4c73ac888eb4f1c485b1b245ec4dfb574e25fc5a7dda85f7961f10478dda830d67142f0f0b118237759f0774e1d4d7b965203ebc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba5QM:A3k03kHRJi
- TLSH T18125AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 985KB
- SHA256 a7e96a2bafd95609341340b6da241f87daa7281af8ea12c84fed2147e56d15aa
- MD5 cc6e7dec651c168c924feaa5f87407f1
- SHA1 409917debbce970d7218e142e50aa4b2c6f5c783
- SHA512 5d0c9aa311d3446811c8acf167a7ba9d42faa7c625e95fada90f814af6b5fb64c3b5f1ee5efd31119a4aca99ed4f48d0903dd01d9c2cb7be8eaceda02911677d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba5RT:A3k03kHRJW
- TLSH T1FA25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.0MB
- SHA256 7dea546598ab952b544de6b56c9b1f3a8dbd2df8ecad6c96efdd940a7b2aabe2
- MD5 831cb3b90ddd018ed7cf9719717793e2
- SHA1 2a0ebb84c64ff05adaadd4ad3c30f071ef785ef4
- SHA512 09655b16c1cb778ba68c18b334bdaaa267149e491a94cc2e15dd12917de6820a9112e95bb328c65e428059f5d50303c8ca62f5975960d5b6ef6cacf905ca9f75
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba57F:A3k03kHRJK
- TLSH T11A359E03E7D500E5D64A8130DE9A8A22FA35BD92176096EF1368F7152F727D0BF3A394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 1.4MB
- SHA256 5ceb000dd3a131d131a1d63ce4559e5f2be49bffa6305a2a89c4191aee60b18b
- MD5 edd6d842e5bce81371250c6fdb69afdd
- SHA1 29d18f231afdbcabaaac1bfdc236ef60667721c7
- SHA512 fae2ff973d5dc1f41740477e60f596950ace9c6842b9c8b97d6350dbd0ebfa385e16cd6e5a7dd7663ddcb318c11a1aeaa87c0068f843363a9aebcf989d0a9781
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapejQba5/BOkUhMXcBwc04nA:A3k03kHRJUUasqc
- TLSH T1F565CF23E79000B6D2964171E9A58631FF79B9052B20C2EF5358DA193F767C0BBBB352
- MD5 SHA1 SHA512 SSDEEP TLSH