Analysis
- max time kernel
112s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 05:59
Behavioral task
behavioral1
Sample
2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.6MB
- Sample260714-gp5hashs6z
- SHA256 49241f418121c598073580f9a5b87be4a5975561bc23a31979b9c4ebeb7961fb
- MD5 d6b25f6ea9885cfebd932e433f5d565a
- SHA1 04e9e02d6f56c51b9e7796052f523dd7a7d04bf4
- SHA512 1b5d4856d4f2f538dc360e94d537e42cf7c4b5bda065edfd531f66c8aa089a973122fb29fa6db394b4515bf00dee8b87f4e09ee485779e3356a33059b6675a9f
- SSDEEP 49152:A3k03kHRJARJA56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHR+Rrr+cFfkZcRjo
- TLSH T1B1062A16F6788762D077C0B9C5D2AA9AFA3238415F308ACB0345D76C2E277D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5852-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c54c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5852-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1404-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00110000000184e4-235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199b2-557.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0bc-1019.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c54c-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x00110000000184e4-235.dat aspack_v212_v242 behavioral2/files/0x00030000000199b2-557.dat aspack_v212_v242 behavioral2/files/0x000300000001a0bc-1019.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1404 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5852 2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1404 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_d6b25f6ea9885cfebd932e433f5d565a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5852
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.6MB
- SHA256 49241f418121c598073580f9a5b87be4a5975561bc23a31979b9c4ebeb7961fb
- MD5 d6b25f6ea9885cfebd932e433f5d565a
- SHA1 04e9e02d6f56c51b9e7796052f523dd7a7d04bf4
- SHA512 1b5d4856d4f2f538dc360e94d537e42cf7c4b5bda065edfd531f66c8aa089a973122fb29fa6db394b4515bf00dee8b87f4e09ee485779e3356a33059b6675a9f
- SSDEEP 49152:A3k03kHRJARJA56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHR+Rrr+cFfkZcRjo
- TLSH T1B1062A16F6788762D077C0B9C5D2AA9AFA3238415F308ACB0345D76C2E277D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.1MB
- SHA256 f84cd3219b192110f0bcdf3a5296662cefb2a26bb669cf3fe2cd70af9643e1de
- MD5 5d9ccfa9cd67e20099f0970e43c3eea1
- SHA1 8b2a6a530a8bf8674c83855f6c53fe629dc98133
- SHA512 2c6eaa23a1c500b48f75bb0554890881a8def7d52e1e374434927a2ece0623d186cbb6150ad2bbbb417f9cdd6ae22cc0921fbb0ec49ce9286a33bc93d6f255af
- SSDEEP 49152:A3k03kHRJARJA56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHR+Rrr+cFfkZcRjo0jo
- TLSH T161161A16F6788776D077C0B9C5D2A69AFA3238425B308ACB0345D76C2E277D5C93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe$
- Size 3.6MB
- SHA256 0992f0273ba85c89d9a060cd6fe2c259b583d898e0a1ff19648d44efd351b2a5
- MD5 a8e4958ddced6a53023287c7bdb9025a
- SHA1 105fc34f00e4394f661819c40bb1b9645b70ae46
- SHA512 68a4a750fe0cc3abc784adf50ab777965cd72e562c29f3a11525535e18bfbcbe2064be2df6d16328294ad966e3c217e8ca152dca3ce3825c7d328386b2f171b9
- SSDEEP 49152:A3k03kHRJARJA56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbBPji0Aje:A3k03kHR+Rrr+cFfkZcRjoa
- TLSH T1F6062A16F6788762D077C0B9C5D2AA9AFA3238415F308ACB0345D76C2E277D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 3.6MB
- SHA256 527a55d7b5efee998e337d5b219466784a146f4881c6457a5b5d3c6b2548b231
- MD5 065e28b11d4437b098935e0dbc79937c
- SHA1 bdc35f7a5fc55f013a5fe5a87bcc4e9abbff8f1a
- SHA512 af63a1d7d2f23f0a6552a6c5d88a391d192d53455fab00d272e201f3702753fe3aafb234efa4757638cafde332da5a228cc2b063eb6effa82005739c529465b4
- SSDEEP 49152:A3k03kHRJARJA56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbBPji0AjB:A3k03kHR+Rrr+cFfkZcRjol
- TLSH T14F062A16F6788762D077C0B9C5D2AA9AFA3238415F308ACB0345D76C2E277D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 4.1MB
- SHA256 fb541bcc98b15959665ae6dbb30500899a0f78dd9e03e08fc9dfc24306f5dc11
- MD5 5626520d4938229d0072eb05d34ca8b0
- SHA1 d46844addb9dbcae9b6ce13f90591414fef5b047
- SHA512 c5fecfa804cd16db713521511965d9f6ac859b6ef9ddcc2c8af6ce68bb75aae2b41966e1acf39488fb1ba190c063c6b4d406a3e0703f92e90f4537a467a0e9b3
- SSDEEP 49152:A3k03kHRJARJA56r+qJtb2IdqJtb2IEeW4SkZP4sz9MbBPji0AjW8tDZqrKV:A3k03kHR+Rrr+cFfkZcRjo6m
- TLSH T132163A16F6788772D077C079C5D2AAAAFA7238411F308BCB0245D76D2F276D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH