Analysis
- max time kernel
91s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 16:17
Behavioral task
behavioral1
Sample
2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.1MB
- Sample260709-trv3vsdt3p
- SHA256 0c2d8b2d53fe1ecf77334cd57bc1359531b722f7fff62e48f7e24d94d6723e7c
- MD5 de64fa109671afb84f60af0c0a05660a
- SHA1 e0189bd1263465e2ad5f0fe04d96a8e34b88969c
- SHA512 d80bfe85db7350019a00a760df37ad9b3f7faae2295b36f551d62fef6876441766ac8a8f1d54b036128f0d6643ecb3ddfddfe5393a31f81a50c8008e651cc837
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiB:A3k03kHRJb8tDZqrK0qJtb2I
- TLSH T1C7A56B16E7A442E5E067C178C6E696B6FA7278421B3097CB1345C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4812-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233b3-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3740-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4812-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3740-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002366f-167.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245dc-813.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0021000000020242-1530.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00020000000233b3-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x000200000002366f-167.dat aspack_v212_v242 behavioral1/files/0x00070000000245dc-813.dat aspack_v212_v242 behavioral1/files/0x0021000000020242-1530.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3740 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4812 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 3740 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4812
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3740
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 0c2d8b2d53fe1ecf77334cd57bc1359531b722f7fff62e48f7e24d94d6723e7c
- MD5 de64fa109671afb84f60af0c0a05660a
- SHA1 e0189bd1263465e2ad5f0fe04d96a8e34b88969c
- SHA512 d80bfe85db7350019a00a760df37ad9b3f7faae2295b36f551d62fef6876441766ac8a8f1d54b036128f0d6643ecb3ddfddfe5393a31f81a50c8008e651cc837
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiB:A3k03kHRJb8tDZqrK0qJtb2I
- TLSH T1C7A56B16E7A442E5E067C178C6E696B6FA7278421B3097CB1345C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.5MB
- SHA256 baa5c9fe5a438086c34a53ed246ef3c17bec1d3e5e44b07e76ac7204f771c318
- MD5 0b19a43f7eb523b52050b4c9653fa11b
- SHA1 dedef856c7a05ffc6791cb0d762dae7b67fd096c
- SHA512 ca37c07e29a58c4712416d72473c88dcb09bbe32cd3a18215dc1c4010b41faf82774d98315ac3defd25e451a267e045805ec51336c1d145cdf07a83d0744085c
- SSDEEP 49152:A3k03kHRJb8tDZqrK0qJtb2IFTd9CHKyao:A3k03kHR9rGCqo
- TLSH T129C56B16F7A442E5E077C174C9A29676FA7278421B309ACF1394D22D2F337D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 650089f4b5f174889f107cf6e8b45f3ad6ec4c2c9bbb4648934b03bc9b82a7e1
- MD5 b965d6ceba7dea382f55d94a49b8eb28
- SHA1 b0d34c723b92882c4c47227cc649a3764040f401
- SHA512 11b2f7098a262e0bdd1f4599e8f84b58c564e92be42d4ceeab0f3c15da9515f10d8ffee2d6739b498dd05d605e170da3e65b55f463fa053ee264f9874885d667
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMil:A3k03kHRJb8tDZqrK0qJtb2IRPji0Aj
- TLSH T1FAC56B16F6A443B5D073C179C5E296BAFA7238421B3086CB5385D32D2F277E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 2.2MB
- SHA256 9f647b664efc7ea507501642d42e29fa13cd44286dea591502336162d42759ba
- MD5 e3f4d4eedcd8ac7b068524d930515118
- SHA1 41f8eaac37e1700415f9b2256fced2e44c026065
- SHA512 c64a0401f0b63968338cf9bdba2a386f97c4579ac96a4cd2412ec9ae93187645eba42cf2f8de642963460715e92576fa1dd416695c103b345743a9414ea5fcfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiS:A3k03kHRJb8tDZqrK0qJtb2I6
- TLSH T1DCB55B16E6A442A5D06EC174C7E29676FA7378411BB097CB13C4D23D2F336D09EBA722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe
- Size 2.3MB
- SHA256 9e5e940b98421f21e086e8663d8ce9a94589781212e4b3d7ae56eb832b8fa8d1
- MD5 ed060564f0aba07ae49154e05b06be08
- SHA1 a26ad8b7d8b803be2fdd1a31edff149f2f6dfd14
- SHA512 c3abc05c428197836c380f2e44131aef7425ce88d6dbf8406dfdffd06d437f1bde5986867c05e7f580e4447b09a0ef7d6925508e1f4696d8a1e0b166bffae0fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMik:A3k03kHRJb8tDZqrK0qJtb2IPTeX
- TLSH T1A9B56A16E7A442E5E067C178C5E29676FA7278421B3097CB1355C32E2F237E1AE3A721
- MD5 SHA1 SHA512 SSDEEP TLSH