General
- Target 2026-07-17_8fddda645041c4e1cce293bbd58d405a_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 2.6MB
- Sample260717-jj1chaev9l
- SHA256 b01ac5d2066af8df7c6c4121e198621e586405a2178784610fbc1faf7b5e6440
- MD5 8fddda645041c4e1cce293bbd58d405a
- SHA1 93e2753accdae702a0d4bcaf18fee31566d159d9
- SHA512 1a262213621b990bbae3b03cfa7de82cc6a19548ec92b2d6d9e392d95271d3942e70e4e98e1ea5051b2eb1dea0b5983f34fa526f0c9ae47e4a71dadb0addf563
- SSDEEP 49152:wabH/mabH/wturNp5jgjI45TMwwapIgTI:K6dtLapI9
- TLSH T1C6C5082275A204AAC589C031EF26462557D13C798FF1A7FBB248B7D52F729C13E3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_8fddda645041c4e1cce293bbd58d405a_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_8fddda645041c4e1cce293bbd58d405a_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_8fddda645041c4e1cce293bbd58d405a_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 2.6MB
- SHA256 b01ac5d2066af8df7c6c4121e198621e586405a2178784610fbc1faf7b5e6440
- MD5 8fddda645041c4e1cce293bbd58d405a
- SHA1 93e2753accdae702a0d4bcaf18fee31566d159d9
- SHA512 1a262213621b990bbae3b03cfa7de82cc6a19548ec92b2d6d9e392d95271d3942e70e4e98e1ea5051b2eb1dea0b5983f34fa526f0c9ae47e4a71dadb0addf563
- SSDEEP 49152:wabH/mabH/wturNp5jgjI45TMwwapIgTI:K6dtLapI9
- TLSH T1C6C5082275A204AAC589C031EF26462557D13C798FF1A7FBB248B7D52F729C13E3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1