Analysis
- max time kernel
83s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 14:02
Behavioral task
behavioral1
Sample
2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 1.0MB
- Sample260729-rcc8dsxwav
- SHA256 6cc4555149d60437c839eb5a5ee7f2550ee029c9203a44f0d4fb2a006a6e7334
- MD5 ecc05a77a76986abaf330e0938894dcf
- SHA1 d6b34597fa0b7071ccca5f98cab53ffcb3d6031c
- SHA512 0abf59ce582482243d79562c361e0c2f556c9d650f3bc6a92098f7e3198f8ce9f338360f780fe785f3993893abfc8df0cdd16f0eb7106f1b88fc81effb833b96
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/oEaEEiHF:A3kMhT1Lljt
- TLSH T108358D52E7D004E5DA578134DDA64A12E771BCA20B60CAEF136477261F333D0BE3ABA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/1708-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3564-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244e7-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1708-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3564-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235b8-140.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000733-1672.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244e7-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235b8-140.dat aspack_v212_v242 behavioral1/files/0x0004000000000733-1672.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3564 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1708 2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3564 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_ecc05a77a76986abaf330e0938894dcf_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1708
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.0MB
- SHA256 6cc4555149d60437c839eb5a5ee7f2550ee029c9203a44f0d4fb2a006a6e7334
- MD5 ecc05a77a76986abaf330e0938894dcf
- SHA1 d6b34597fa0b7071ccca5f98cab53ffcb3d6031c
- SHA512 0abf59ce582482243d79562c361e0c2f556c9d650f3bc6a92098f7e3198f8ce9f338360f780fe785f3993893abfc8df0cdd16f0eb7106f1b88fc81effb833b96
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/oEaEEiHF:A3kMhT1Lljt
- TLSH T108358D52E7D004E5DA578134DDA64A12E771BCA20B60CAEF136477261F333D0BE3ABA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
- Size 1.1MB
- SHA256 fdebede6621afb4464cf38d945129418bf76bd03b7f6264b6e878d2020987a01
- MD5 e97ad89b94eea01dc703493339655138
- SHA1 a3fb910c52548a234213b2fdbed0b979605c0e30
- SHA512 b400c01817e4dca4cbca914244cf0ffb0080aeb4a5edb449a3b425bb7ffe0203478acfb0a60982dc9e8dddb820487c3af2480f22f0e89bc19fd304111e2ffd20
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/oEaEEiHgGen:A3kMhT1LljXI
- TLSH T15B458D43E7E014E5EA578134CDA54A12E772BCA10B60DAEF136477261F333D0AE3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 836b89aef63411859415db235852535d29124c7a6ee2fe0be2f7aaa1ec63ac76
- MD5 0a0f262b4d52f9b54168f942770abeb8
- SHA1 a2eef460d83c94cf1c00d802adc172f4fe0d4da8
- SHA512 7377d5c509d63c49774372ce30154d348796d8d28e63a2ee45e2bfd4d5256e6ecb10e76f734b08e6e69934e5945cd19a190a12bd89630babdbbcd59980bd9511
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/oEaEEiHB0Le5ji0hmxNrM:A3kMhT1Llj5Pji0Aj
- TLSH T1C9757C16F6A402B5D473C079C9D69A5AEA717C820B30CADF0354B7292F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.2MB
- SHA256 741dc2aa8a65c70719218a749dce7b7383fabf35b97373d6c78be7981f47eb8b
- MD5 34970ad4bddefadb45ed4aa5674af103
- SHA1 d762ce686ccce372106b3f4b362760e16f6b3b70
- SHA512 b7e5c00e10d13c705d7f2974ef34dd941a9d859716c090992d722ba3faf6eb6db1287439f7f95ea3b1c9f4b3ce6f41a05c92de6300e580545a6d56c0f0edb2d0
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/oEaEEiHKD:A3kMhT1LljS
- TLSH T1EB453842E69004E5D95E8134CB954A12F673BC6507E08AEF13E4F63E1F33290AEE9767
- MD5 SHA1 SHA512 SSDEEP TLSH