Analysis
- max time kernel
113s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:45
Behavioral task
behavioral1
Sample
2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260718-ea8kasaw6t
- SHA256 bf35858e2cc538497901ba7bcbb276c1a4e261d17df3fea936e788bb4ad14e09
- MD5 5a0bc891e4b4976238a65286573cd3fd
- SHA1 85da16686df1d2fff2984003e5412b7907238e7f
- SHA512 8a1b80ae727c6be82646324d457846314c537cccb2708b6a1e2b10c3c18d14026980d0db0e650eb123bde5650bba001087759b890a4f997b6091def823f88697
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRiD:A3k03kHRJx
- TLSH T1BD355907E69400A9D10E8174D7964A22FA777C5657E092CB23D8D23D2F62BC06FFA397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4164-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5cd-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4164-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1720-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-450.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bacf-457.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cca-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000140-2074.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5cd-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-450.dat aspack_v212_v242 behavioral2/files/0x000200000001bacf-457.dat aspack_v212_v242 behavioral2/files/0x0003000000019cca-1274.dat aspack_v212_v242 behavioral2/files/0x0004000000000140-2074.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1720 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4164 2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1720 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a0bc891e4b4976238a65286573cd3fd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4164
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 bf35858e2cc538497901ba7bcbb276c1a4e261d17df3fea936e788bb4ad14e09
- MD5 5a0bc891e4b4976238a65286573cd3fd
- SHA1 85da16686df1d2fff2984003e5412b7907238e7f
- SHA512 8a1b80ae727c6be82646324d457846314c537cccb2708b6a1e2b10c3c18d14026980d0db0e650eb123bde5650bba001087759b890a4f997b6091def823f88697
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRiD:A3k03kHRJx
- TLSH T1BD355907E69400A9D10E8174D7964A22FA777C5657E092CB23D8D23D2F62BC06FFA397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 151c29b747063f9884a56690713b7a4a99e8e81aba4fc9774258d2fff72bb5b3
- MD5 2ef77319845699281b879d27dcb43ef3
- SHA1 6aa8d368a92cddbce45df5fb5f646683badcb4f4
- SHA512 4f7736ac3944483cee73cfe76d5c66f703deca34cfad0911d65917cd3c7d999cc08363a662f14f585a802ba370c0f88daf7704b317438aff9f74365e41f69313
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRi/0Le5ji0hmxNrM:A3k03kHRJNPji0Aj
- TLSH T1F6756B16E6A402A5D02EC174C7D6965AFA73384217F086CB13D4D63C2F63BD19AFA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 1.3MB
- SHA256 25312b9a8506b216e67ceecf6e83fa5b8472d9dacfec48f1cb30a9728408a77b
- MD5 9416f8f93ed4ce6004dc633f09a1bc9d
- SHA1 5fded05d135068e7ade1d4bea5e6e1a91ac07591
- SHA512 1f3268883cafd816649f754de4f1af851873609848bd7cdad2ccab4f72c2fff33f5c551fe93f4979f49faf439a94a6914b832b230ceb22c1beef7e0b12384ae8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRi5jCXF7IwZ:A3k03kHRJjC17IwZ
- TLSH T120557B17E69400A5D15E8174DB968622FA777C1617E092CB13D8D23D2F22BC06FF93AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 1.1MB
- SHA256 ef3167efa915493907723687ef8848511c150110bb37cba8acde2f2caf301599
- MD5 ce61acd7af4886da07757f7921dd67a9
- SHA1 46a62f33bbae0a2d1361109dea287987ce6ef52b
- SHA512 dc63185af4f83ecc9b1b42aad5ec984be656e12c755f65099d75d1abfa50da73ac8b3545ef88b8ec8ed62f8bf710052ca8de67a2d100f800d7f1b7a6b8743302
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRiUL:A3k03kHRJW
- TLSH T1B4355907E69400A9D10E8174D7964622FA777C5657E092CB23D8D23D2F62BC06FFA3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.1MB
- SHA256 2fd1790ee77694d91bc2cedba9fe5434e492c4bd976919f3c4706b179280f6a9
- MD5 66785945f36e77fd84476b01ba19ff15
- SHA1 04a1b366f47803980f866b1a22fd58634daaa26a
- SHA512 877bc63a8b1c6214d2127dcac11a49dc3e2bf88ec6845e975ea67881fc5396d9e48baeedd0786d9cba5d87255f9929ea6605314bfd9f98f9dc65906a933a7fb2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRibF:A3k03kHRJX
- TLSH T14A455A03D69400A5D54E8130DB9A4622FA377D9217E096EB23D8F63D2F727C06AF9397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe$
- Size 1.5MB
- SHA256 f84e53c7908f7d468dad234d6d842b29c0edf4376b188d906ab8b34d8ed4702a
- MD5 9870b4da376f2963830c00b2a56f9cbe
- SHA1 223a6b7ce26e1f8664594f563df1df8f35e5b1b4
- SHA512 8070233c4c5e9e94198d5cec3827deee9d50caa87e3bb78b826001bb75306558063c7f4a2758492be7328f1c3267ec38b2d9c7dfa7f46971de2dd285bd188a42
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmaZRiRBOkUhMXcBwcy0G:A3k03kHRJVUasqci
- TLSH T17F759D23E69000A6D15E4171EB958621FE3BB9152BE082DB53D4EA3D2F716C06BFB353
- MD5 SHA1 SHA512 SSDEEP TLSH