Analysis
- max time kernel
97s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 04:28
Behavioral task
behavioral1
Sample
2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.1MB
- Sample260707-e3pb5aey6m
- SHA256 dfb65478ed725d96002d0dd85a7b48e153080da4b73b1ddebb2c3be832b10805
- MD5 34dee157e055ebac6fd6420b5c40d46c
- SHA1 27d77180b257ef89f56e148c71e3d64f4cc80e6a
- SHA512 d64cbfa64f4193fc84658d34a462f4b5e67349b0b9297b65d24935025faccaa8fe68e357235feb0a62fbc1e2ef93d65e5207cc00bbb8b817a4fe0e6372a37686
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2I:A3k03kHRjfkZckrr+
- TLSH T1ABE52A16F6788762D07BC079C6D2AA5AFA3338415F7086CB0285D73C2F276D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4932-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002459e-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1732-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001db14-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4932-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1732-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023523-133.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c6-551.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000168e3-1638.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000074f-2055.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002459e-5.dat aspack_v212_v242 behavioral1/files/0x000300000001db14-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023523-133.dat aspack_v212_v242 behavioral1/files/0x00020000000212c6-551.dat aspack_v212_v242 behavioral1/files/0x00070000000168e3-1638.dat aspack_v212_v242 behavioral1/files/0x000300000000074f-2055.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1732 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe$ 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe$ 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4932 2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1732 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_34dee157e055ebac6fd6420b5c40d46c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4932
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1732
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 dfb65478ed725d96002d0dd85a7b48e153080da4b73b1ddebb2c3be832b10805
- MD5 34dee157e055ebac6fd6420b5c40d46c
- SHA1 27d77180b257ef89f56e148c71e3d64f4cc80e6a
- SHA512 d64cbfa64f4193fc84658d34a462f4b5e67349b0b9297b65d24935025faccaa8fe68e357235feb0a62fbc1e2ef93d65e5207cc00bbb8b817a4fe0e6372a37686
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2I:A3k03kHRjfkZckrr+
- TLSH T1ABE52A16F6788762D07BC079C6D2AA5AFA3338415F7086CB0285D73C2F276D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 3.6MB
- SHA256 b8b4dd811d50c33788bf29a5e36bb25ecfc1f0b4cbd0417729c278daa25387cf
- MD5 595c639d0b81ad45625a6babb95cb82c
- SHA1 da35e2b348f10bd27901bd4eb5d759c4a10940df
- SHA512 9c7f08f5c0fb82a36f74fbab507f182755a6037bd11535b4eb40c18780973a31f6e163f4468b6bc2a2d26384343347d1880d10cf50f52e0de59f3b0416861dc0
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2IkUidGl:A3k03kHRjfkZckrr+ddGl
- TLSH T15A062A16F6788762D07BC079C6D2965AFA3338425F7086CB0285D73C2F277D59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 c3bf971aa1c62016fd58dc43e5b209634d18173c65fdcf694c8f73e1be0e7610
- MD5 af6bb1bf61bb50f3b9244c44a9c1549c
- SHA1 ed8f5fe81a2fb0c4c13b1619a721c91337ed8b5e
- SHA512 afb5d900aa3dd3b9f51190a50b09633706224d9048c1b46d36c282d77a890d14b3a93c24fd3cd10a463019010ee911505b8ae2b0ad54ffed16699b6f661c9e6f
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2IQPji0Aj:A3k03kHRjfkZckrr+Zjo
- TLSH T195061A16F6788762D07BC079C6D2A69AFA3338415F708ACB0285D73C2F276D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 3.2MB
- SHA256 19439785e681a82edff19709674bf6ce2a67831e7a4649bbcf1d09bc3a25ea7a
- MD5 8c97f2be16a01cc5ecdc411ab22a4efe
- SHA1 eaf381233102680da68528eb00b53ec0ef5bd123
- SHA512 3e5e04281f8fc68d5df35efade4ca4c773c0783dda8684f1b0e6ec31ec6c37314587f793f3744c15b16b29be8ee370ab99961e6d133392d3012f9f564928c06f
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2It:A3k03kHRjfkZckrr+y
- TLSH T12AF50816F2688762D07FC079C7D2A65AFA3338415BB086CB02C5D63C2F276D599B6723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$
- Size 3.1MB
- SHA256 303178effb387a5659584d4b8384cca9a98a049d5301b3e54063ad2442295692
- MD5 2d39ce95b88c5bc8eab53c97ad85411c
- SHA1 c327f01e15306a51acd4311af303784ef0c5f101
- SHA512 753b8c18c1ff2fbbb94c800826270f0b4647b3e040586390a43ab05ce08b44016a52533923f6f9fd29023f4b2a8c0b2b711ddcf53b5e8194954db054acd5b787
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2IA:A3k03kHRjfkZckrr+T
- TLSH T195E52A16F6788762D07BC079C6D2AA5AFA3338415F7086CB0285D73C2F276D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
- Size 3.3MB
- SHA256 b98f3d610732b192d95a2f8196f8a54dc2867fb4e37624473433260d9c0d2fd7
- MD5 095209da138860f2680a5cb948f1cdcf
- SHA1 6e0d1413b4ddea494454cfd8d74a03c19f166ada
- SHA512 f0cebd24305713a20d2cafb8fc9d6655b6ad3993c808d949646e4d3a7e2132d45ad6d102d568c6cef82573a3cd4632642a08732b5c9f405b392b30789420096f
- SSDEEP 49152:A3k03kHRJFeW4SkZP4sz9MbkqJtb2Iz56r+qJtb2Iai2WH3:A3k03kHRjfkZckrr+JuX
- TLSH T1D2F51926F6788762D07BC079C6D2A65AFA3338425F7086CB0285D73C2F276D59936723
- MD5 SHA1 SHA512 SSDEEP TLSH