Analysis
- max time kernel
114s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:21
Behavioral task
behavioral1
Sample
2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 957KB
- Sample260730-dwct3sycph
- SHA256 7108a2f678832c44a0ac9cbd57055b0f443523bf357d06d2b1c064fdd7c08fe9
- MD5 7234d97adcaa0c9d498a647e78e34091
- SHA1 56a6bece892f8a9b22cb42e261ad79a101775e6f
- SHA512 c538ea862eca734c961cb55d02d73f8f10e22357dbdaf8736fff9f6e2ab807fed9ff1f6ad0d1890764149d0beb6fe37d5b0eabee0ec823dc69e6265b5f4e3ed7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDFKhooc:A3kMGT1LljO
- TLSH T19425BF13E79014F9E917813499E54A12EBB1BC261B60C7DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4620-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c57a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4620-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5492-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199ae-585.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c57a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-406.dat aspack_v212_v242 behavioral2/files/0x00030000000199ae-585.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5492 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4620 2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5492 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7234d97adcaa0c9d498a647e78e34091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4620
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 957KB
- SHA256 7108a2f678832c44a0ac9cbd57055b0f443523bf357d06d2b1c064fdd7c08fe9
- MD5 7234d97adcaa0c9d498a647e78e34091
- SHA1 56a6bece892f8a9b22cb42e261ad79a101775e6f
- SHA512 c538ea862eca734c961cb55d02d73f8f10e22357dbdaf8736fff9f6e2ab807fed9ff1f6ad0d1890764149d0beb6fe37d5b0eabee0ec823dc69e6265b5f4e3ed7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDFKhooc:A3kMGT1LljO
- TLSH T19425BF13E79014F9E917813499E54A12EBB1BC261B60C7DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 51e1fea991a8aa619a77913d2ce8032bbb523c322d128e4c655c7f6e3a744214
- MD5 fe7f8bee45148903f6ede51e3e01fb28
- SHA1 bcc86944dd372342f951d65bfbc02ac440063dd4
- SHA512 8d90423517864edf3035337a3fbe7ad96ae2917d99021dfcd3c6535ddff8619c4d09d66508940f981c21022ce5576be417630a9703c5a3b4ae34e4bbade7118a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDFKhook0Le5ji0hmxNrM:A3kMGT1Llj+Pji0Aj
- TLSH T152658D16F6B406B5E073C179C9D29A5AEA7138421B30CACF1398D7292F337D19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 972KB
- SHA256 4dc3aa158f227fb25fb79c36721363a89eafa962abc7036ba98a69418f23e823
- MD5 04ff804732ab78cb3d61e5f71ce807de
- SHA1 a42a5640113c1c18d93f7d9a3d0c762473525bf5
- SHA512 abefb3f365e8eda6b31cccf574cfba80c5f4023177b977a3a106ff1f48044dd59984299550577ed8aec6174f3d7ab250d0c9fef1da5ee8ee6371982800ebca58
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDFKhooOa:A3kMGT1Llj
- TLSH T16E25BF13E79014F9E917813499E54A12EBB1BC261B60C7DF136892262F337D0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
- Size 981KB
- SHA256 5a17b07cd655c1aeab4b983059adebfba7765d657425e077917471d7371652da
- MD5 715aac0d0bef12405e249e769b28a3dd
- SHA1 663f295ba92da229029455f115aa522064df417d
- SHA512 ee7414ac4b45273f407aa4645ba17a36889fcf04d13e88338d96454439b4f479cb6a1e9b364a36a7a2dd7402ae6a5639a8cfc75366d927bc820b30c5bebdf960
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDFKhooMg:A3kMGT1Llj7
- TLSH T17425BF13E79004F5E917813499E54A12EBB1BC661B60C7DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 981KB
- SHA256 f7bdb99079e7195077f8dde5b867550e35ed66b51c34ae64e2f2715227c43840
- MD5 eae2385a8324f37503a2256459d4a464
- SHA1 5825dfce721392301d46bc78b6ba48e92eac7a0a
- SHA512 f4cc6b6867bbf233bf5320a3f8a1932130c63467a3d77f04b8ab7f3cee23968b8971455f50af67f10fe6dbdb9e15bffa46d1f52f66fd42789220df7fe0e9f483
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDFKhooi9:A3kMGT1LljC
- TLSH T1F025BF13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH