Analysis
- max time kernel
92s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 08:22
Behavioral task
behavioral1
Sample
2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 1.5MB
- Sample260709-j9vvpsez7r
- SHA256 a6b5153b0bbebb19caf8178c366be42b35e8ecc66832c28abe8190dba4bbcf4f
- MD5 8196ee098b50286189bf8b4aff753508
- SHA1 18d43280d444efc87f95ebc50c3f23e6d680473a
- SHA512 f4f93464b1190e556c2202e8cc8ac5441a0023d01a111be1c8f1a90572fe2af5f35e35a04dde56f1460ab93a4bf770fc9054f005e32fd49239c9a44ce16c52e9
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrM:A3kMhT1LljxPji0Aj
- TLSH T1C5654A16F6A402A5D06EC179CB929656FA73385207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/5764-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c635-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5764-165-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3776-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000184cb-294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019998-556.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019991-558.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b8e-694.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b2b-696.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cb2-1294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019be0-1541.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c635-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x00190000000184cb-294.dat aspack_v212_v242 behavioral2/files/0x0003000000019998-556.dat aspack_v212_v242 behavioral2/files/0x0003000000019991-558.dat aspack_v212_v242 behavioral2/files/0x0003000000019b8e-694.dat aspack_v212_v242 behavioral2/files/0x0003000000019b2b-696.dat aspack_v212_v242 behavioral2/files/0x0004000000019cb2-1294.dat aspack_v212_v242 behavioral2/files/0x0004000000019be0-1541.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3776 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{67FE4B20-14A9-4D58-AD2B-A2631C9F5302}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe - Drops file in Windows directory 46 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5764 2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3776 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_8196ee098b50286189bf8b4aff753508_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5764
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 a6b5153b0bbebb19caf8178c366be42b35e8ecc66832c28abe8190dba4bbcf4f
- MD5 8196ee098b50286189bf8b4aff753508
- SHA1 18d43280d444efc87f95ebc50c3f23e6d680473a
- SHA512 f4f93464b1190e556c2202e8cc8ac5441a0023d01a111be1c8f1a90572fe2af5f35e35a04dde56f1460ab93a4bf770fc9054f005e32fd49239c9a44ce16c52e9
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrM:A3kMhT1LljxPji0Aj
- TLSH T1C5654A16F6A402A5D06EC179CB929656FA73385207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 1.9MB
- SHA256 195268391fdecac2a1c8aab38f03869221a664630ebf3183aaa5504a9b5ccc24
- MD5 c5ed07f1f41560aacc2e19994b565ddd
- SHA1 ac43220699638354b6407267b489010cd3563be2
- SHA512 199aa09e6edb54059d1b94fe71dbafc3e21a825af5bfb700a354c4c723e25740b6e77347f119bd8532d37e33b3266ab944ea37816792e8788303c7fb8a3ef9dc
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMX3Td9CHKy7GZO:A3kMhT1LljxPji0AjoTd9CHKyao
- TLSH T10D953A56E2A402A4D07BC175CBA25656FA73385507B0CACF03D4D63D2F336D19ABAB23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 ddb1610e5732af2b0f6521a37cd05e1f724db2a0552273688a35e65af0610b4d
- MD5 0d7dc6500610028aa81c14cc3c6c5ae5
- SHA1 3b70ab1cf09ed839aebb67d2451dcad6d601b622
- SHA512 7bdca50163dda4090f3c9f8edb821f1f6e46c2a5d0d1ea93047aba50c282197039ccc38ce950d243f139b4de9fca0e3e10ae9f767fa40ec8d8c93ddaf6bd0990
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3kMhT1LljxPji0AjKPji0Aj
- TLSH T1B4A52916F66442B5D07AC079C7D2965AFA73344207B08ACB03D5D67C2F276E18ABA733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 1.5MB
- SHA256 84a0ede39665d681916efc78ab62849ade628b9aa302434f443a5b8064330b7e
- MD5 419f62e87e8f5d814c7ebca708c13832
- SHA1 6ee9ad59f2a234ae69ac4e84b8c137b65c2cd083
- SHA512 3b26378f4c56f5f5ba2594dd4c5b4c2c63b151c679e0a89c7d83b6dfcba9e3b22db636ff06fc196f77a62eaf9a81f0157222e51cb22cfd03b4455392bb10e6ab
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMbC:A3kMhT1LljxPji0AjB
- TLSH T17F754A16F6A402A5D06EC179CB929656FA73385207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 1.5MB
- SHA256 cdcf384009aa57eb92be949a42d5c2ed99841d03de5bdd2ab98b1eba627d33e6
- MD5 303fdc5c980b4c73f14a49bedded6c53
- SHA1 116495aa236794ba6aab90ae95c466955c0da18f
- SHA512 fa0bdde079fef2ff65495cebf5d93677d0e35fcd773b1446ec662c47423afc10176a47d08a6f1505a450a78af371ab2fd00c1a83665dbb0ee6086e1230ee9932
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMXj:A3kMhT1LljxPji0Ajs
- TLSH T16A755A16F6A402A5D06EC179CB929656FA73384207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$
- Size 1.5MB
- SHA256 3ec95f6ae5df62c18d9c5ff87762bf1af1aa9129057ae05e7065ba6c51f3c6bb
- MD5 07af84e4d35d12abcedfa00ec91dbe53
- SHA1 1a0b5fa415fba8a864d64a4730eaec5b338b9ad0
- SHA512 f782a91961ba63022bc97b6f57a051a6bfb3245fe9033e7e56d36713f24bcfe5e8aea5617191c0a18f8fd286dc7ad8f26375523211b1d6d9ac173a2129cd704c
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMja:A3kMhT1LljxPji0AjB
- TLSH T171755A16F6A402A5D06EC179CB929656FA73385207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 1.5MB
- SHA256 b16b52c2a531ea8d1a222ec61bcdf10a1e8bcd46446fd7b880727874fa6c81fe
- MD5 6752d5018c4f74a3fc6f62eba668ca5d
- SHA1 0a82bc1097f93b461598456aaf1cbef58e5f01ec
- SHA512 ddcbbf89a102008ea5be372b500ed04895045d370202551816d289632e3f13e8f8db5f9ff80c0721e4ea37b8fb817b71b7f7de8fec6e0e47356deb79c7c80d88
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMuC:A3kMhT1LljxPji0Ajg
- TLSH T136755A16F6A402A5D06EC179CB929656FA73385207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 1.5MB
- SHA256 9bbe692eb2dcfd434adb7f9b13ebaefd00229577c1863cc6345fdaa1a20a7ec1
- MD5 8ccceec25b4032cf3c121939fe0e1167
- SHA1 6f2121e7edd7a69b44310c9d1761e07b2d992fc1
- SHA512 04ebea0e66ffd003fa6e29a0dc00ecbddacb2146d3e71982080b0e473d04ed081748dc6f8787d4b918190b23d647d8a6c1c19251151b1c3e274eb95fbd4201e6
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMjs:A3kMhT1LljxPji0Ajf
- TLSH T1DF755A16F6A402A5D06EC179CB929656FA73385207F086CB03D4D63D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 1.5MB
- SHA256 96fab034208e3b0e1edefe9c43b0fa46618f26b6da0faca05277ad2cba31de91
- MD5 f1b92a65a78c17fff12853ccd21aac6b
- SHA1 cfa33e598162189130748a5f44a90cb6ce2642cc
- SHA512 76419b51a77d7dd04087f646eccc4b20d86342348b24b3bcc5f82451123b9b3332c6d6c5c1a1c0fd90a160794e41ee94e12c5c945bbad77d49b78675790335ca
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpeufEP0Le5ji0hmxNrMPF:A3kMhT1LljxPji0Ajq
- TLSH T1B1754A16E2A402A5D06E8075CB969656FA733C5107B08ADB03D4F73D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH