Analysis
- max time kernel
118s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:37
Behavioral task
behavioral1
Sample
2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260730-d6mr2ayepg
- SHA256 4f742d8ce023f3e73b236ad1ea97b5894273f0fb1f7ac551a8255d1032073178
- MD5 40f1e1a613d595fc7b3ac8f3d06859d9
- SHA1 a918bd39fd234ac24a855316a903bf321499df64
- SHA512 154369d355f7de647dc3fb30c20b53cbfcf9cdd2ff89e25e510f6b994bb35f4bf877e1ef3038a660c1cdb1f86f4a263fd47d0d67998a74d1e67f89215568b138
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWGDQhZCD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJd56rTPji0Aj
- TLSH T1D3856B16F6A44BA5D02FC178C5D2965AEA733C425F3087CB1354DE283F63BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2904-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c32c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2904-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abb2-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8f-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000000165-2121.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c358-2119.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c32c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000700000001abb2-1022.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8f-1279.dat aspack_v212_v242 behavioral2/files/0x000c000000000165-2121.dat aspack_v212_v242 behavioral2/files/0x000d00000001c358-2119.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4684 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe$ 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_40f1e1a613d595fc7b3ac8f3d06859d9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2904
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 4f742d8ce023f3e73b236ad1ea97b5894273f0fb1f7ac551a8255d1032073178
- MD5 40f1e1a613d595fc7b3ac8f3d06859d9
- SHA1 a918bd39fd234ac24a855316a903bf321499df64
- SHA512 154369d355f7de647dc3fb30c20b53cbfcf9cdd2ff89e25e510f6b994bb35f4bf877e1ef3038a660c1cdb1f86f4a263fd47d0d67998a74d1e67f89215568b138
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWGDQhZCD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJd56rTPji0Aj
- TLSH T1D3856B16F6A44BA5D02FC178C5D2965AEA733C425F3087CB1354DE283F63BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 244f9313479782a556896daf9174d81ef36b31aee0cfc224cd3df828784b9d7e
- MD5 434d68b7f310f2118a9edd291cd5e1a9
- SHA1 18b550fdf15a7bd1dc6de8580b059199ba11da1a
- SHA512 9de51ab12f003e6d7209fe2c6311aee2251b45b4ba2741d12b74125b2a2092904c8ca9028dfe5a3d616a82cca8cb0473724f15b08e796db3abee6c501e502795
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWGDQhZCD5TvinrmC0Le5ji0hmxNrMDD:A3k03kHRJd56rTPji0AjKPji0Aj
- TLSH T13CB56C16F6A44B75D02BC0B9C5D2969AEA723C421F3087CB1355DB283F677D19A3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.7MB
- SHA256 3ac7cfdc6f6fef1542f81e5e5d5a08360aeb98631d6fe2ef6dcac6391657503f
- MD5 60bf1a5a703c980ba36ba760d4576224
- SHA1 a70e85f3795d9a413e6f609bf64e39556d7f5071
- SHA512 c732322a016fe8d261edc80fe4c438fce53e89976cd6af98f2f033a30a7e09aa9dd5b87dbbc34769e3dbad2783a7c5aacec3d61c913f0f3a919701fb42222be4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWGDQhZCD5TvinrmC0Le5ji0hmxNrMPF:A3k03kHRJd56rTPji0Ajq
- TLSH T1F9855B16E6A40BA5D06BC074C9D69656EA733C421F3087DB1354BF283F337D1AA3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.7MB
- SHA256 19c2fc1c07890991b39ea26863112490c6d15d5c57941c7b3d665d45be749758
- MD5 4c30a79d583b7200ce4f70d756acce5d
- SHA1 f0dcad8a7843d2fa6547847fa7366108e213c00b
- SHA512 f5c16b5ee181c466436bd402e7016978c0052d78324f0f493a8311eb91e480f76b4d47777c431d6147dc2674f0d64c68150f352b0eab37156b25bf3671985932
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWGDQhZCD5TvinrmC0Le5ji0hmxNrMuP:A3k03kHRJd56rTPji0Aj7
- TLSH T155856B16F6A44BA5D02FC174C5D2966AEA733C421F3087CB1354DE293F63BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe
- Size 1.8MB
- SHA256 7c89c69325789229819ab2f12615d62c97a81b09ed1470faabd870e2e7e6a1a2
- MD5 eb09da666cb74ae10848f3df442edc57
- SHA1 d78faad90ec373b2d98391623e2831902d75c5b9
- SHA512 09b9606ec7d07996c7b03a629aa51a65fb77d52013288d63ee22cb72ed24c2a205de8792823076b4c4ec0567efa7da1baed1c6f480cb25d240f58ca26031a029
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWGDQhZCD5TvinrmC0Le5ji0hmxNrMbw:A3k03kHRJd56rTPji0AjmIiHq
- TLSH T1C8956B16F6A80BA5D06FC174C5E29656EA733C421F3087CF13549A293F63BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$
- Size 2.2MB
- SHA256 48b4ab20604470ca33f7fdc7a8f98203cc8cf759c49602b67a4d5c06005f4bf5
- MD5 68d341afbfc43332306b4b9d4229df86
- SHA1 5b9076234c4be3ea55585df399b54b7cd877f817
- SHA512 47ce3addd29d243a967f2ac595128637c078ad3431900780c542da48ff50f3f2408b0ae767cf4283e42a2493c0e473f80ad0b13daae21c2216838ec30abbd26c
- SSDEEP 49152:A3k03kHRJd56rTPji0AjdO6VeAVXMHqfEv6mWF:A3k03kHRArLjo5MHDvo
- TLSH T11BB59D17F6A80BA5D02BC174C5D2965AEA733C461F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH