Analysis
- max time kernel
79s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 22:41
Behavioral task
behavioral1
Sample
2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260709-2mlbvsav4l
- SHA256 6f3da539bdf5409f4af49f5e887c3202a8f3a210e18464c2d9158129aa89c3cb
- MD5 d0b3a351a71e63f61ac7b438ee357adc
- SHA1 a7a7f126be3d86df4e231ed2ce3793fb0bd56672
- SHA512 7a655f085a75ca80b093c58de1c0c2c4fd7ac5016cefeaed563231806972e5ee940c02f29de6cd0c58b77e8069ce565e5745be25bf4f29354974e4707baf5b74
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04sz+:A3k03kB56rxeW4SkZP4sz9MbE56rX
- TLSH T1F3A52816F6784B62D06FC079C5D66A66FA333C465F2087CB0345AF283E276D1963A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/1748-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024398-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4792-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1748-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4792-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021b9f-935.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002a000000021654-1263.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001700000001e73d-1549.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024398-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021b9f-935.dat aspack_v212_v242 behavioral1/files/0x002a000000021654-1263.dat aspack_v212_v242 behavioral1/files/0x001700000001e73d-1549.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4792 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1748 2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4792 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d0b3a351a71e63f61ac7b438ee357adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1748
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 6f3da539bdf5409f4af49f5e887c3202a8f3a210e18464c2d9158129aa89c3cb
- MD5 d0b3a351a71e63f61ac7b438ee357adc
- SHA1 a7a7f126be3d86df4e231ed2ce3793fb0bd56672
- SHA512 7a655f085a75ca80b093c58de1c0c2c4fd7ac5016cefeaed563231806972e5ee940c02f29de6cd0c58b77e8069ce565e5745be25bf4f29354974e4707baf5b74
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04sz+:A3k03kB56rxeW4SkZP4sz9MbE56rX
- TLSH T1F3A52816F6784B62D06FC079C5D66A66FA333C465F2087CB0345AF283E276D1963A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 2.5MB
- SHA256 b793fac4f72b58591212ed16cfaf2220c16b9bd60cbd06abf9eb45a0ab58ccee
- MD5 4fc2545520b02f2ac958e56eaec91f74
- SHA1 f9a193ee157f59cfdbde47cf3e29bd2c03a13b06
- SHA512 f2ab6a3911996f77815667fe6e1e083a97a994032d4b6500887b00286025daace2da750b24626528e6dd90855cf1c36c378e8ce0bcf76462ec2db24f99e403c9
- SSDEEP 49152:A3k03kB56rxeW4SkZP4sz9MbE56rOT9t2:A3k03kCrlfkZcBrg2
- TLSH T1EBC53916F6A84B66D06FC074C5969A56FA733C465F2087CB0344AF283F376D19A3A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 528e020cf4018cc114b2a3ef01571b0af3ef7a8afdc5807ada74d9a1a596e3e7
- MD5 0c9d26c7b3d027abaa313c3d59b48b63
- SHA1 8703e543fc8df5718857c9a5da4d5c4350e5d808
- SHA512 a5a9a552ceebe32b025e1e4343196132d8be331bc94f439f5f3bcee77fb8918c05496d5643f4345a31b352cb50758506742a553a039260fca37712c3b5a129f1
- SSDEEP 49152:A3k03kB56rxeW4SkZP4sz9MbE56rTPji0Aj:A3k03kCrlfkZcBrLjo
- TLSH T178C52916F6784B62D07BC0B9C5D2A69AFA333C455F3087CB03459F283E276D1963A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$
- Size 2.6MB
- SHA256 2b25e0e6a6245348c98cfe84f6ee3fbe8b138f89974c6767d175b0796ea9a09f
- MD5 f66f81db0e6a0e39f90bf4d1fda2d56a
- SHA1 98e0f53a0554a0d745af8fe14c064e64d48fd452
- SHA512 a9215c6d96fa308d9790244da8946484bc40b0445c132420ee47e3e182bf84b2c0bad878856d0b87ddefdb4933636e9b720e7768c44fad7a7bd1cdce9c0da5a7
- SSDEEP 49152:A3k03kB56rxeW4SkZP4sz9MbE56rQIWmKmd7DAS0S:A3k03kCrlfkZcBrQxGX
- TLSH T138C53916E6A84BA6D06FC075C5965666FA733C061F2087CB0344EF293F376D19A3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.0MB
- SHA256 64761fe8e9113b82ab626c079b437dee07f83c773514735bc6e04e86f7819cad
- MD5 9c5971250ff2fef8800d397a3c4e7a24
- SHA1 663ba5c527c72d30a4a11ef4b93a5cf00f046fa8
- SHA512 b13f849827dec02245273d02736a32f347d94b68fda4cb25d22061c757ee809d27de9fdf0a6502fd93cb5105fc7f6207ff719836e3b8c6bf46ba70d51bd93eeb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04szW:A3k03kB56rxeW4SkZP4sz9MbE56r9
- TLSH T13AA51816F6A84B62D0ABC075C9D69A56FA333C455F208BDB0344BF283E376D19639327
- MD5 SHA1 SHA512 SSDEEP TLSH