Analysis
- max time kernel
119s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 15:41
Behavioral task
behavioral1
Sample
2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260715-s4658aa16w
- SHA256 f02db67b7ad5903ac8846721ca698239ccc19148c0efbf655e2913ce6bc4a0f2
- MD5 3d16302375f3417c62f280c869c0a6f5
- SHA1 3b2a4a2b475bd837aae566db32a7213b18cfdb70
- SHA512 08baaf00314cf02b734d88e4b456918461091a598fd779b51b787f9b36abaa65d47733c799dccd6bf64bd6fca676be7de00782d3928acd6be6d72aeaaf34e927
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmGZ:x7iw2356rH
- TLSH T13F35291766E84E94E46FA13089A54656E673BC551F3083CF12689F293E33BF0AD38727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4380-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c43a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4380-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5604-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-425.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9a-1285.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00210000000188a8-1546.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000000137-2112.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c43a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-425.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9a-1285.dat aspack_v212_v242 behavioral2/files/0x00210000000188a8-1546.dat aspack_v212_v242 behavioral2/files/0x000b000000000137-2112.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5604 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4380 2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5604 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3d16302375f3417c62f280c869c0a6f5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4380
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 f02db67b7ad5903ac8846721ca698239ccc19148c0efbf655e2913ce6bc4a0f2
- MD5 3d16302375f3417c62f280c869c0a6f5
- SHA1 3b2a4a2b475bd837aae566db32a7213b18cfdb70
- SHA512 08baaf00314cf02b734d88e4b456918461091a598fd779b51b787f9b36abaa65d47733c799dccd6bf64bd6fca676be7de00782d3928acd6be6d72aeaaf34e927
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmGZ:x7iw2356rH
- TLSH T13F35291766E84E94E46FA13089A54656E673BC551F3083CF12689F293E33BF0AD38727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 1.6MB
- SHA256 af6965c7514629906af079afc6fce91ca9e7221cbc5c5d10bb361c4cac3685a0
- MD5 d1073f26cc3bda14e2620caf6010be11
- SHA1 0de287f4babc327c85207faf32d881ff1800edcd
- SHA512 8568d38b3d75b85fc0d0d58773374e1927597b8b6190781b1e2cd88cef6da6aa7c173e6fa901c45fa8937cf84612dac74e03964fcd795ffe9cc586fa5651b24f
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmG086n9kAJ9tA3L:x7iw2356reT9t2
- TLSH T196754A0666E84F94E06F913489A54646EA73BC551F3093CF12A49F293F33BF06E39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 0f268c8b3dd2efc72382b0e361d83477b9f19a663540663152edb0fd30297b0f
- MD5 5450f7d1baa5389abf26e7b190371712
- SHA1 e634e686c566336e49d69d435efe7e2e102a0105
- SHA512 50c43b2526415ea1a2ecac6d6d575fba09c78c763c396a03a3e2e357a4b1de3ab07eacb89aec60dc5c981d8fa269cafd8412b410ebe4aa7768012700ada355b0
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmGF0Le5ji0hmxNrM:x7iw2356rDPji0Aj
- TLSH T1CA853A16B6A84B61D07B9174C5E64646EA73BC451F3087CF02689F2C3E33BE1AD39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe$
- Size 1.1MB
- SHA256 eee9f23d7bf39ef91070cc783f4d11d011014bec2c30d22d7ef5404107173e11
- MD5 8b9fc36d1c362439252b0f8f14bcd21b
- SHA1 b1e8bd1c64c6561fa72d097e24f977a773f05b5d
- SHA512 9097538b1f7a1a84dd19c1f9a9fa4baaa7d062b6f7d6f17c2a3114e12f5fd2c3e9e414dc1e88b18f1ee50551c1e03af4bf1fa72d7cc0ae7cea2ff434a78e6392
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmGC+:x7iw2356rJ
- TLSH T12E45291766E80E94E56FA13085A54656EA73BC551F3083CF12689F293E33BF0AD38727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.2MB
- SHA256 469ec92e798958fcb5592ed6063d934df5eedc7cdbffd261ab04d1474b583f5f
- MD5 81471e5c662c4303b43166e24a59e8ef
- SHA1 035d6a01da38d42b617f6b477d66e44807fd00ca
- SHA512 2a29d6beb4735a670f3cd6e55bd9e843108243732540b602eb3b476a67afdafaabe307be589135270ea430b29448bda5e61d0aa823e26b29dbb52a8805f72edb
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmGFF:x7iw2356rN
- TLSH T11745190766E80E94D5AB613089A54651EA73BC551F2087DF1268BF293E33BF0BD38727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 1.1MB
- SHA256 a438c1b0c763a808ef0ef5f77fbdcd77c81e46bc06a535c55800f87c05d0c571
- MD5 555a220e79ce3cdd09ac802ace9e8167
- SHA1 60806ad137ab3f9829703ebf3fcb1961682d4e18
- SHA512 9e666bf416067e0546427b81edd78161c426b9b4d5d96adc0db03644978769f6463ddfa2679507f179c627cb83829f8f63ecbf506764206b70458d6167ffd74f
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplOaEMD5TvinrmG/:x7iw2356rt
- TLSH T11C45291766E80E94D46FA13085A54646EA73BC551F3083CF12689F293E73BF0AD3972B
- MD5 SHA1 SHA512 SSDEEP TLSH