Analysis
- max time kernel
115s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 15:32
Behavioral task
behavioral1
Sample
2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 972KB
- Sample260711-sym56afv91
- SHA256 bd9ab649af0c2e2a1c9a863f73b979b207f24b2a0e814eeadc2a4db4f1c3655f
- MD5 b07c514ba548d750fc7a0b9ca6437b08
- SHA1 8bb0c804ac60e4a8abbdab7727fa99b04e3426e6
- SHA512 5263c59646a64f79a5cea7ee34526ac2220107fb0ac67f816821ae90acbdcdc3529210e74fc80e2539dab37e57a464939bd3384f59b8eba5a28bc6ee3a2b414e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnQ6:A3k03kB56rxP
- TLSH T1E1257C03E6940FA5D10FC1749A958662EA777C425F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/860-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c519-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/860-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4756-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001ac36-1204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000019d33-1253.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c519-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-395.dat aspack_v212_v242 behavioral2/files/0x000800000001ac36-1204.dat aspack_v212_v242 behavioral2/files/0x0008000000019d33-1253.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4756 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 860 2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_b07c514ba548d750fc7a0b9ca6437b08_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:860
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 972KB
- SHA256 bd9ab649af0c2e2a1c9a863f73b979b207f24b2a0e814eeadc2a4db4f1c3655f
- MD5 b07c514ba548d750fc7a0b9ca6437b08
- SHA1 8bb0c804ac60e4a8abbdab7727fa99b04e3426e6
- SHA512 5263c59646a64f79a5cea7ee34526ac2220107fb0ac67f816821ae90acbdcdc3529210e74fc80e2539dab37e57a464939bd3384f59b8eba5a28bc6ee3a2b414e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnQ6:A3k03kB56rxP
- TLSH T1E1257C03E6940FA5D10FC1749A958662EA777C425F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 163f48bfde132dbafb000d02ae9f6db702745a71d413c108a9b0036bd82155ea
- MD5 93cd197851c0672e012cefa1ed92c350
- SHA1 0b1e7bf6ee8f8c95c3d597c99a739373e1001d6c
- SHA512 8ecdf26391b3b56d99e074592d17469bbfe9c85dcd0f95f9177a727ba191379190920aaec1dfc2f032c1db1570fb821aa2dc082b152369e74b5a0f531ed1b8ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnQK0Le5ji0hmxNrM:A3k03kB56rx7Pji0Aj
- TLSH T18C755A16F6A44B65D02FC174C5D2966AEA733C421F3087CB1354EE283F63BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 995KB
- SHA256 a6ded18aa4efd01882107f1b681283a1b63a009998ee362c7578f6165d682250
- MD5 1e2351df4cabab1caef62c2334e4c480
- SHA1 e0319f5b816254316966d4a25422f0ce6636ffe4
- SHA512 601189ab6593a16d339dfc2acb32eb28e4c3cdab358052e90b61ace3af892f6f79b5479c39aaa68ef73953a8d87a0f6e55bdd9fcd561945df53498f323c2e4e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnQCu:A3k03kB56rx2
- TLSH T17A258C03E6940FA5D10FC1749A958662EA777C425F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.0MB
- SHA256 f443d1534727c59fb47fefbc0414bfa213bd7f523fa06f278f6bfd82ec80f561
- MD5 833ba80e4709c01c83425500afcb2572
- SHA1 4787f1724ad9befdabf044d16eff9401f7a8c6c1
- SHA512 a40f29de1ff4d77b485a5ea9b995ef57f2c7a487bb206ec21065750aa1cc15f78cab32139b8ae1e394669c5b593df5daececd8f3338a4350edd87b1ddd74c9d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnQ4F:A3k03kB56rx1
- TLSH T1B8356A03E6950FA5D64F81309E958622EA377D821F2097EF2358BF253F327C06A39657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe
- Size 1.4MB
- SHA256 2ca7fab273a634d1cce2ff0a83316c3940ddf2ed5155f30085322f443b61c364
- MD5 c87cc496a214698348fd1f061038c5b4
- SHA1 cef146d92420c08372b4f69c6013fdd78271bbc6
- SHA512 d1ff5763a014775beac3413f2b126bcced1d94dabc7e66c1b8a07672f41a8163b810092c2af06fd07656642cec2a38b97ee272fa993d9c33bae33e91a8692e0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnQAi6:A3k03kB56rxBi6
- TLSH T14F652983AB469EB5F00F84349591823D96737E1D1FD347CB624E7E067B357882AF821A
- MD5 SHA1 SHA512 SSDEEP TLSH