Analysis
- max time kernel
103s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 23:55
Behavioral task
behavioral1
Sample
2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 971KB
- Sample260710-3yffesas8v
- SHA256 66865d2260558817c51978c798209d99470392cca54c78851aae1ec4012fc9c0
- MD5 66da26761a4a0d9019fda7a0f30fd4fd
- SHA1 1dab7378f4841c582477112424a0d16e4eafe5e2
- SHA512 55f4ef07843e9d97741418c8018c3234832b6b3cc0bb861ca9cf6a79bc7cbc34fea829bba9e156afe1799bdc877bb3ee84b85f15eb78bd5ba3c01f51aea9f072
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETw:A3k03kHRJA
- TLSH T1B025AE13E79500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4744-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000016cbe-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4744-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1080-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd3-654.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019de8-1019.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00160000000188be-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001500000000079a-1984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000000014a-2117.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000600000001b815-5.dat aspack_v212_v242 behavioral2/files/0x0005000000016cbe-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd3-654.dat aspack_v212_v242 behavioral2/files/0x0004000000019de8-1019.dat aspack_v212_v242 behavioral2/files/0x00160000000188be-1221.dat aspack_v212_v242 behavioral2/files/0x001500000000079a-1984.dat aspack_v212_v242 behavioral2/files/0x000a00000000014a-2117.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1080 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4744 2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1080 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_66da26761a4a0d9019fda7a0f30fd4fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4744
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 971KB
- SHA256 66865d2260558817c51978c798209d99470392cca54c78851aae1ec4012fc9c0
- MD5 66da26761a4a0d9019fda7a0f30fd4fd
- SHA1 1dab7378f4841c582477112424a0d16e4eafe5e2
- SHA512 55f4ef07843e9d97741418c8018c3234832b6b3cc0bb861ca9cf6a79bc7cbc34fea829bba9e156afe1799bdc877bb3ee84b85f15eb78bd5ba3c01f51aea9f072
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETw:A3k03kHRJA
- TLSH T1B025AE13E79500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 4f2f20c01c43a083859e0d19894d7377bdecfdd6f4c51aa54721842975f2c54c
- MD5 f6e983d6cb2097382410a8a03f09ec33
- SHA1 facd7011351ad3ccdde8be3059d3302d15885fbe
- SHA512 55edc7e886a3f24d100c42eec69fc8ec6e1ab018b38c7b03fc24eceebdaf4f474d8ae58f88eab8333cf693387952a9242ed336489936f44ea819921f2b2e6e26
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETI0Le5ji0hmxNrM:A3k03kHRJYPji0Aj
- TLSH T1E1757C17F6A402B5D027C1B9C5D69A5AFA7138421B3086CF1399C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 994KB
- SHA256 c43cf07331bf29d4b50f2220a03c9cd8da3340aac8f9fe310c131ac5a4a778b4
- MD5 28732defeb9b6421a3f7466f7d008a14
- SHA1 83f4114219925fe801cf0f4abf560541997a0ed1
- SHA512 8bbd5f00bf72ffa7477260419bad3855224409ecfa7e3452cded5c86807359109b2ba985b10af81f752b21f6fc8883a68ec720b53170348f1bbe0d981d394c2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETFQ:A3k03kHRJK
- TLSH T15225AE13EB9500E9E10AC17496D65A23FB75BC52176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1015KB
- SHA256 fa8693c788a4ab8dfe917fea101a87d75cf71d971a0bd4ce5683ccf21f51a12e
- MD5 8e107a61293410cc15b6c30cd058b4b2
- SHA1 02d9352d7b490c164e5d8941e575406daee89b47
- SHA512 6c5aac21547f7e5055b0e9ea88e15b25caadad71c1b946e8f5b70335474c6799a103f5d00560564542990a6fc1dfda2f12c1abbbf573787d40712daefc219e53
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgET5wE:A3k03kHRJt
- TLSH T1DB25AE03E79500E5E10AC17496E69A23FB75BD52176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
- Size 1.4MB
- SHA256 c555f3226b2ffbd7da9876b7a1b8a8ef7456f6b7baaf239890e64098d4f271e2
- MD5 2a86340909e2b12848739c52949d2a5c
- SHA1 3fb828bd825faf5d4b322aec0892c0e8d6de9198
- SHA512 c805af156a6cbc767618f0af6c3d98b318b7b32a81a6f95bf7dc6d1ff9c749c6c9a2688c86ffbdcca89424b2b8893464b3589d11940e2e2ec1024df90e970bf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETii6:A3k03kHRJSi6
- TLSH T1D6654983AB469CF5F10D84349591823DA6777E2D07E386CB635E7E0A5F357882AF8318
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.0MB
- SHA256 ef649b38172cddb8b1aae41f78f9f197a9ad43aea962d6c7c0c72c48977fdc18
- MD5 af5ffd883b94df6cd5ff7f553356f3ee
- SHA1 66a304d86935549e59042c21d766c343b84f3c08
- SHA512 b61db0ab7d2943bfe144a7f867e90a172300b097524b27b1c2783dd58c526a4113bf090976ccbfa56d5dab13e42bc959b305bd97007442b1341e94cc537b8bf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETVvxl:A3k03kHRJFvxl
- TLSH T13C35AE03EB9400E5D10AC1749AE69A23FB75BC52176093DF2358D6152F72BD0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 1016KB
- SHA256 bc590a80767cd4191e1e3ba8bf4758a0fab5b557e0bcd085d3f6d5e18b564963
- MD5 468b4c4c8c0ac3cd768c6737607e6cae
- SHA1 5a7bc1227eb7eef9fb89b33fb8e1fc28581f9d4e
- SHA512 a99fd9e42dcd66c1139760dcd0fab13e0bfe02594adb20d36455c91c1c8683eaa1f20b7bea62cd23052a27da7063cbb6ef9e75bab4f485cbf010251c126a79ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaZgETA:A3k03kHRJQ
- TLSH T16D25AE17EB9400E5D11AC1749AE58A23FB75BC52176093DF2368C2152F62BD0BF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH