Analysis
- max time kernel
105s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 17:24
Behavioral task
behavioral1
Sample
2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.2MB
- Sample260708-vypebsdv2m
- SHA256 79c014a7d49c435e927a4f7567ba5f8de6709d7e6a44339c59d8c829a3ab9fd4
- MD5 9209ef08a14cc21a65ef59b28ab1898d
- SHA1 a6d42bac0639edb710bdf37475a2182819d30712
- SHA512 3ad14500545278efc9a612524e7e8ef344cbd2e3bdf869f145373f684f91d95f527cf352fb7393985c784517c07db29b41d48a9174359b2c2dcacdc86c6697a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl/0:A3k03kHRJspYqLeW4SkZP4sz9Mb
- TLSH T1D3B53A16F6788372D0B3C0B9C5D6AA5AFA32344657308ACB0349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5928-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b80e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000016cb3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5928-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5804-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bace-219.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019851-221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac2e-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019ca4-1296.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b80e-5.dat aspack_v212_v242 behavioral2/files/0x0005000000016cb3-11.dat aspack_v212_v242 behavioral2/files/0x000300000001bace-219.dat aspack_v212_v242 behavioral2/files/0x0004000000019851-221.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-426.dat aspack_v212_v242 behavioral2/files/0x000700000001ac2e-1178.dat aspack_v212_v242 behavioral2/files/0x0004000000019ca4-1296.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5804 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe - Drops file in Windows directory 46 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5928 2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5804 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9209ef08a14cc21a65ef59b28ab1898d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5928
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 79c014a7d49c435e927a4f7567ba5f8de6709d7e6a44339c59d8c829a3ab9fd4
- MD5 9209ef08a14cc21a65ef59b28ab1898d
- SHA1 a6d42bac0639edb710bdf37475a2182819d30712
- SHA512 3ad14500545278efc9a612524e7e8ef344cbd2e3bdf869f145373f684f91d95f527cf352fb7393985c784517c07db29b41d48a9174359b2c2dcacdc86c6697a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl/0:A3k03kHRJspYqLeW4SkZP4sz9Mb
- TLSH T1D3B53A16F6788372D0B3C0B9C5D6AA5AFA32344657308ACB0349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 35ec7f409b889f0d46f357bb0194355da917c2049d2d27af2da09d75dbdc90da
- MD5 2ecb68190f07eb78bc1bce3eb3d1a61c
- SHA1 ada25277a3b589562bfd1f5902d0541cca7f3ba3
- SHA512 5dd73fb3153e53fad5600e3a21e7533b96d44ee45eaa7a44ef055e2ba84a1d58133f872f24269fc8b83bc9b43e188b1e250965639c7397c6ab4709b7a0cb3288
- SSDEEP 49152:A3k03kHRJspYqLeW4SkZP4sz9MbzPji0Aj:A3k03kHRm6YfkZcrjo
- TLSH T13CD52A16F6788372D073C0B9C5D6AA9AFA32344617308ACB0349D76C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 2.2MB
- SHA256 4454df04e0ec4b9c43943cc5247ce5d83f60639b7ed1369b88677df8fddfb5a1
- MD5 dcd15ea748bc0e6dd8e2a5cf74231163
- SHA1 77e0ffb1b8b4d0431c1ac1c2963dc56c1e28be7b
- SHA512 21c55465548ea9186365d4055602ad06f30a383acd00fef58d59362e7fc183a96ef2a26cfa602e8c9b7265e1ff830dd9944001aaffc98ed8702ce1870467a4f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl/L:A3k03kHRJspYqLeW4SkZP4sz9Mb6
- TLSH T1DEB53A16F6788362D0B3C0B9C5D6AA5AFE32344617308ACB1349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$
- Size 2.2MB
- SHA256 6494952f3399c37549b8a80670880b6f94a296f74ce6576fd60a1c5dd520cdb8
- MD5 d1f9e524778c415080d31011b39fae91
- SHA1 dd1275b649b150b4e647abe0fb59b995f0d1b2f1
- SHA512 02fb872f8e502ef9473a29ab262ddd737a414b5d52ba52c9d773bf9b7bb6f07a0fa33149670e42c435a521c047e3ac9a19ddacf6b12baf44262000ecd2093165
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl/P:A3k03kHRJspYqLeW4SkZP4sz9MbG
- TLSH T1B3B53A16F6788362D0B3C0B9C5D6AA5AFE32344617308ACB1349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 2.2MB
- SHA256 25f4bfac6314d54dcf6511017b88de830e747201b79621c698ec0b770a0ebe8e
- MD5 bf0375d9d940fec99e9d480966409d72
- SHA1 d9174635e36f9745a8ae329a357d9fa1d396ffec
- SHA512 1ebfe06b0260e070e0aed54731012e55676244e3e40f7b162130e2b7be64def29406b33b5dfebfb09900fc6c5f6adedfac975ed22c61ab7fd03b01a2e5ff66e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl/a:A3k03kHRJspYqLeW4SkZP4sz9MbH
- TLSH T1CAB53A16F6788372D0B3C0B9C5D6AA5AFA32344617308ACB1349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe
- Size 3.0MB
- SHA256 9dd20458ae4148783ef5004238f122e594794523f1366bd914f90d8b6b224fe1
- MD5 c46136b1160bce83e089fec52c03df1c
- SHA1 e7c9560185f0ccb8e5aed154d90e5bdde01c0dfb
- SHA512 697df794425eacde05a4b2b70edb2722e170956205ee52c953fe97df67f1514415932b94fb144f265b1c714f0804ee11f6e3f54b04e753044467db2aae85a61d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl//:A3k03kHRJspYqLeW4SkZP4sz9Mbm
- TLSH T18BE51702F6684222DC6E8D75C592AA76F9313C4F7F2CB6CB0E45B3282E376D19535326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.3MB
- SHA256 de8426c46025e2b833735f540e13cea9c1e8fe86fa3aeb6e665f6fe28501b972
- MD5 6d517ac366085100ad506d673cf89d1a
- SHA1 55fd6defffaf3f0eeefaef1094063cb1e5677d97
- SHA512 6bcd4174a40c8641f2bd9f2aa1f1a33f39910e8f4403b40ee062fb09e6b6ad5647c35f453962f4262aadd44f6ce648f5e3381a81b70adaede5eed82fb6a2d84c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEBCWe5jcAkSYqyExZe0p4Ek4niOkl/w:A3k03kHRJspYqLeW4SkZP4sz9Mbd
- TLSH T1F9B53B16F6B84362D0B3C0B9C9D6AA5AFA313C4517308ADB0345E7282F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH