Analysis
- max time kernel
119s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 06:09
Behavioral task
behavioral1
Sample
2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260802-gws3vaeb28
- SHA256 7334c4e7e40a0b1633620d9f14c7b376e8d360050d83f753901505d818dbd016
- MD5 51ff97a6eccc477c86c274a41718ca62
- SHA1 0b6b62dad34b23ac13b7fb6fd3786f476da7c8a3
- SHA512 7b66be68849d1f9a5c750aeef14ed88d79a3ac6aa63ba4fd730792f0ef37808c5b322f6c189e3572bf59108ad665a040134b849b002bc62a973897213d797fd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbRT2SYTqMi8CtBd2QHCHmTBW5DF:A3k03kHRJQqJtb2Ig
- TLSH T104756B16F6A442A5D067C074C9D69A56FE323C821B308ADF1349F7292F337D1EA3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/3044-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c469-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3044-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3012-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-407.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-405.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019959-497.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c469-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-407.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-405.dat aspack_v212_v242 behavioral2/files/0x0003000000019959-497.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3012 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3044 2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3012 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_51ff97a6eccc477c86c274a41718ca62_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3044
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 7334c4e7e40a0b1633620d9f14c7b376e8d360050d83f753901505d818dbd016
- MD5 51ff97a6eccc477c86c274a41718ca62
- SHA1 0b6b62dad34b23ac13b7fb6fd3786f476da7c8a3
- SHA512 7b66be68849d1f9a5c750aeef14ed88d79a3ac6aa63ba4fd730792f0ef37808c5b322f6c189e3572bf59108ad665a040134b849b002bc62a973897213d797fd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbRT2SYTqMi8CtBd2QHCHmTBW5DF:A3k03kHRJQqJtb2Ig
- TLSH T104756B16F6A442A5D067C074C9D69A56FE323C821B308ADF1349F7292F337D1EA3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 6589fe67b002cedb33424e63aebd976cc138e217258238a7838f0338364a34c3
- MD5 096f841ffb32593cc43172f17f3bedd4
- SHA1 2ac04efb8417d47d56baa10c553c4aee9d8f7153
- SHA512 af3db263b8239907daff2c20120d51e8d5990ea5edd27b309ae1060568b16a4abb5febf35feccb8295ac583e464f316f7cd6d06dab39edd6a4e28f6228dafa61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbRT2SYTqMi8CtBd2QHCHmTBW5DBD:A3k03kHRJQqJtb2I4Pji0Aj
- TLSH T1D0A54B16F6A44375D073C079C9D2969AFA313C821B308ADB1389E7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 1.6MB
- SHA256 da72d19bab7b0f6c931b48c5f1d359a4578c60572511d7af3c70e4214bdb0303
- MD5 259f03d104e2dff3f59836facc7b2fb3
- SHA1 42bceb731c69a50436435aba7e583dd8bfc207c8
- SHA512 6a332eb5ac016f9c9717999a350a73119a96746419bedd84e5811b67a68796ae455056dfae7ad34dd905af3b94f5a9ed7da651dae4b5905d5d71278540e7728d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbRT2SYTqMi8CtBd2QHCHmTBW5Dgj:A3k03kHRJQqJtb2Id
- TLSH T163756B16F6A442A5D067C074C9D69A56FE323C821B308ADF1349F7292F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe$
- Size 1.6MB
- SHA256 55b5a7c93c1e5b1c8be120fb5b99561f14070d2f7355863888f8cd0930b21371
- MD5 0fb7721ee878fdee45618e00077bc0aa
- SHA1 a0978f2c80d8f1169b8d458c7551440795b48fd0
- SHA512 4c379bfe444191488e94f2cc80e027fd666eda3d67aff4ed282269a22eca03eef03c296e5471621806072c0ad68eb8932c1c5b98a79ebdc00f0de33de4a43c21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbRT2SYTqMi8CtBd2QHCHmTBW5Dtu:A3k03kHRJQqJtb2IT
- TLSH T1DB756B16F6A442A5D067C074C9D69A56FE323C821B308ADF1349F7292F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 1.6MB
- SHA256 c02bf1597dfc8b89a5d157a8b843c86bb82a14a8baf13099fd580daf787a956d
- MD5 98ad9625088b2e998b43aab4460f8a47
- SHA1 d8c7b16cbf1c8cd44b89f5e32132676f190627d4
- SHA512 a526ce0f1d523086cd5969acb02fc1a800b50bd1aa7c8def0e0a0f10e82bf4d912b06d41dfd7c180ae02706902665a2ac9bf742c9a74d8db277e9f81fe82469f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbRT2SYTqMi8CtBd2QHCHmTBW5D6F:A3k03kHRJQqJtb2I9
- TLSH T149756B16F6A442A5D067C074C9D69A56FE323C821B308ADF1349F7292F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH