Analysis
- max time kernel
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 16:00
Behavioral task
behavioral1
Sample
2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 976KB
- Sample260702-tfwv1set3k
- SHA256 da6dccca99dd28e50e0c81207cbfc8e50267a95b538cc24abf9ba2b27201fe8a
- MD5 fe59c046d38e3f588d8ea4059bc9ee2d
- SHA1 4b427ffb23ae86275dcfe66ec88b8fbb20b254a1
- SHA512 73daa57f5043bd11c1e682c3fa954cd1ddad7ae338706628a3981e7b3809794f9c6ee6778b2721b3cd9d77c1d04828b9221531699b3781e632fb0937a23597d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jA:A3k03kHRJARJ
- TLSH T17A259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/3616-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4a8-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c5-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3616-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1404-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001a1e6-1026.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abe0-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bca-1506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b6d7-1880.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4a8-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c5-11.dat aspack_v212_v242 behavioral2/files/0x000500000001a1e6-1026.dat aspack_v212_v242 behavioral2/files/0x000700000001abe0-1195.dat aspack_v212_v242 behavioral2/files/0x0003000000019bca-1506.dat aspack_v212_v242 behavioral2/files/0x000200000001b6d7-1880.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1404 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3616 2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1404 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_fe59c046d38e3f588d8ea4059bc9ee2d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3616
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 976KB
- SHA256 da6dccca99dd28e50e0c81207cbfc8e50267a95b538cc24abf9ba2b27201fe8a
- MD5 fe59c046d38e3f588d8ea4059bc9ee2d
- SHA1 4b427ffb23ae86275dcfe66ec88b8fbb20b254a1
- SHA512 73daa57f5043bd11c1e682c3fa954cd1ddad7ae338706628a3981e7b3809794f9c6ee6778b2721b3cd9d77c1d04828b9221531699b3781e632fb0937a23597d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jA:A3k03kHRJARJ
- TLSH T17A259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
- Size 1.2MB
- SHA256 0909f5a46f080eb07338a0b7e6999a6a1e6a46d1d91605f024c8fdb81fdde800
- MD5 e0a6bbee63ab7113a9998c5b2acb69e9
- SHA1 a32c18cb6ffdea7133f6e570f9815d58e5fffac7
- SHA512 6ac6902cbe0f5cad4c0fefdb5e15f9dba62002c3f30ce3bdabf8c8452de5daad9f47f4c78c509278f7d8b4c5b1e1baf81070b6b7b97e53ece9c656cad72e1cc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jASZM9zFVSOX:A3k03kHRJARJHZM9zf7
- TLSH T16F559D17F79400F8D55AC1388AA68A22EB727C560720D7CF136896162F73BD0AF3E795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{6C0274E8-4127-48EF-BAB6-125BBC870E1C}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.0MB
- SHA256 e6cf3477e56cb2fb30c882992570a4190c2f0c9882924e4c765ffcd35ed805f6
- MD5 941b20801277bce7d99a928eded04a07
- SHA1 74bfb6a19ebb60c67a346c76bc04cdea45ab8ffc
- SHA512 51ef3713b21b223f13925b68ec870d47f53ee237fef5457666f240f7cbb1acc037ab8b6bf19bcc1518f285f332678551ef169d5ebfeb4b94496db235c21036a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jAZbBPzBAU:A3k03kHRJARJCBPVAU
- TLSH T155359D03F79400E8D15AC1349AE69A22EB76BC52172097DF2354C6162F73BD0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 850ab09dd71e01bae5ee077f546232b6c8851711645ad3962a718107f8afdc49
- MD5 3f35688e8a2246586336a6bf41741976
- SHA1 778a74ee69b5ab24cc128365d2d1d784483656ac
- SHA512 5db57b956dc5c757ea31df6a3ed81ceed0fa7861050c999d26129faac7a3428ac46b30f32f4bc956c311c4faed54321807409468574624c4d12cd9d8ed409002
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jAD0Le5ji0hmxNrM:A3k03kHRJARJePji0Aj
- TLSH T1F9757C17F6A802B5D067C178C5D29A5AEA72384217309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
- Size 1020KB
- SHA256 0bb60bf47ab8500a805805a0015e3a4770b0d243664532c235c25c10d8a3449f
- MD5 c4b91db1467e44ca01a7dae264af6e95
- SHA1 1c4df33d76bd3aab7dda98f6f3579ff64f04ee3f
- SHA512 3aa1dec2fa4021f34f17bf0a171992e86dd8497b5dae5ebb0d2ffc7b58111e1e77679d6540028810dd06d3bcbe510c7edc7f0da1ca1758e827c76b2acc027627
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jAuwE:A3k03kHRJARJH
- TLSH T120259D03E79800E9D15AC1749AA69A23FB757C56173097CF1368C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
- Size 1.0MB
- SHA256 4ed948035059fb15034d7b3b37a65925a0edae81114b12b0b708868777e481d3
- MD5 250601f8292ce5d951e551d92cb82fa8
- SHA1 016792fb66769fbb2c71864be4477e6ad0226085
- SHA512 8af66ab0291d47fa73e4e5febfe34ef64ae6c9cf0b3ad29cd85624df5d5e9c31bc55d98a3e017a91efabcfc96061fc53cb49710e3cd394fc7898d9063982f0d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aEsy83jAg:A3k03kHRJARJj
- TLSH T144356B13E69800E4D10A9134969A9A22EB35FC5A172097DF137CCE152F66BF0BF3D768
- MD5 SHA1 SHA512 SSDEEP TLSH