Analysis
- max time kernel
86s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/07/2026, 20:52
Behavioral task
behavioral1
Sample
2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.2MB
- Sample260724-znsffsshmb
- SHA256 f28f318764c9e3287e2f7a31290cd69169835994e98c5ef357d4cfbceb85bd38
- MD5 7504e8ffe80b521af441d122432bd1c2
- SHA1 672629c3bb3f95d4a23fe3afd4a25254f751a7fc
- SHA512 281f7533a9779f1ce349ca92d82d00aa1deeac3006ae5120ac5fdd7e67504ee60568829f07b9fbeaedea48f1f9957c4154107a35b45d941c8281988f671e2122
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKaTYTqMiB:A3k03kHRJD8tDZqrKvqJtb2I
- TLSH T193B55A16E6A442E5D06EC174C7A29676FA7378410BB096CB13D4D23D2F336D09EBA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/4164-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002454d-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4152-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4164-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4152-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002a000000021638-1248.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1967.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002454d-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x002a000000021638-1248.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1967.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4152 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4164 2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 4152 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_7504e8ffe80b521af441d122432bd1c2_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4164
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 f28f318764c9e3287e2f7a31290cd69169835994e98c5ef357d4cfbceb85bd38
- MD5 7504e8ffe80b521af441d122432bd1c2
- SHA1 672629c3bb3f95d4a23fe3afd4a25254f751a7fc
- SHA512 281f7533a9779f1ce349ca92d82d00aa1deeac3006ae5120ac5fdd7e67504ee60568829f07b9fbeaedea48f1f9957c4154107a35b45d941c8281988f671e2122
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKaTYTqMiB:A3k03kHRJD8tDZqrKvqJtb2I
- TLSH T193B55A16E6A442E5D06EC174C7A29676FA7378410BB096CB13D4D23D2F336D09EBA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 9db53c58017f48f8e7decd03bd01e5a074c47c63b7429f428cc288839ce4e5a0
- MD5 d66b23200bc6a9725e8d8c1143b2f7b3
- SHA1 8e66a088a84dc9ee3f37ec61d97bbd743be42a57
- SHA512 b574deea78130b2cff3013b941e66db2bb547e8cadcd496a2fbf0eccf1188398ead31a6deff8c0146cd36f6b3af9e1938e655cbce770a19c33049021e3b0cde6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKaTYTqMil:A3k03kHRJD8tDZqrKvqJtb2IRPji0Aj
- TLSH T19AD54B16F6A443A5D06BC079C7E29666FA7338410BB086CB03C5D73D2F376D19A7A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.3MB
- SHA256 b52becd938d7d2666046202c7ff87d6d633ee58ae23c20af94455fb92d2ace69
- MD5 d797c3772a4dbcb1fb3b687df74a25fd
- SHA1 e8158d179db0657769613c0bce6e0edc6031e7ee
- SHA512 59680bd7c22422060536ad5864d51e292d2692b57b5d69904300f0073548bfed4aa3a88a99ce95d15d25b6b390276f1590e7d9c2d0b2e42889695c460ae967aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKaTYTqMiL:A3k03kHRJD8tDZqrKvqJtb2IT
- TLSH T1E0B55C16E6A442E1D06A8174CB968676FA737C410BB096CB13D4F73D1F336D09EBA722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.7MB
- SHA256 14d3b36c8b11256d7bd87fa87e32a2caae4bf521afb6a655ab7810565c358e6c
- MD5 711929e9e755e60881b68f5565bfddb9
- SHA1 27d3e9deedb8a7a78bbd1faed180db1fb67974a6
- SHA512 5060d0cc5dd142cc3fb85d5a03e08fdb26e87bf9032df7da9244fc43254617deb89c8b271cc32bb79653ddb57b12191acdf93894ed779d6a900de347adb4a082
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKaTYTqMiG:A3k03kHRJD8tDZqrKvqJtb2IQXpiMh
- TLSH T175D54A12E7A442A5E07B8174CBA69666FA737C510BB086CF13C4D63D1F336D09AB9723
- MD5 SHA1 SHA512 SSDEEP TLSH