Analysis
- max time kernel
122s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:48
Behavioral task
behavioral1
Sample
2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260802-vbge7sxbjd
- SHA256 6103659d3d78dbb21969749a62b700cbfd4f0c2d6af8b4bfda33f24fd0d5c336
- MD5 ccbc48f52eb5db461e93db54c3b39026
- SHA1 239dd2cf2f64607e4b27e7af3bb150ee6a3db985
- SHA512 7443036f6c929681f6343e4e1a1a9e9b0cef5a7de92fcc85410d60ad56e02607902f51514a505258a2331a4e6da09a17a494a024457aad51b880d39f901d5523
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKw/LaERaFZe0p4Ek4niOkl/A04szE87v:A3k03kHRJ1eW4SkZP4sz9Mbd56rX
- TLSH T168952916F6784B62D0BBC079C5D6AA56FA323C455F3087CB03459B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/1384-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c49b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1384-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5972-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-436.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4ad-1648.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001b7dc-1650.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c49b-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-436.dat aspack_v212_v242 behavioral2/files/0x000d00000001c4ad-1648.dat aspack_v212_v242 behavioral2/files/0x000600000001b7dc-1650.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5972 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E03D5D6C-388E-4B12-B85B-347D19A529BC}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1384 2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5972 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ccbc48f52eb5db461e93db54c3b39026_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1384
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 6103659d3d78dbb21969749a62b700cbfd4f0c2d6af8b4bfda33f24fd0d5c336
- MD5 ccbc48f52eb5db461e93db54c3b39026
- SHA1 239dd2cf2f64607e4b27e7af3bb150ee6a3db985
- SHA512 7443036f6c929681f6343e4e1a1a9e9b0cef5a7de92fcc85410d60ad56e02607902f51514a505258a2331a4e6da09a17a494a024457aad51b880d39f901d5523
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKw/LaERaFZe0p4Ek4niOkl/A04szE87v:A3k03kHRJ1eW4SkZP4sz9Mbd56rX
- TLSH T168952916F6784B62D0BBC079C5D6AA56FA323C455F3087CB03459B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe
- Size 2.4MB
- SHA256 4c06e801f7479d97da4da1d4b1b6d800432abdc30cbe81b6f9e6437451981eef
- MD5 1bfab911a7595ebeb0b6a3698414c25c
- SHA1 1281283179708e4e9f4e025bef45a4a542a3a148
- SHA512 9063c13b911ce79e05d53f40f7ddec166e298b5bd725edead31aeb683a23b539d097773e930d7889eebc6f170eb1e06cd5d2a98991ca3bc4dac3d40205e419d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKw/LaERaFZe0p4Ek4niOkl/A04szE87L:A3k03kHRJ1eW4SkZP4sz9Mbd56rOT9t2
- TLSH T1EDC55B16F6B84BA6D07BC079C5D69A56FA723C451F3087CB03449B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$
- Size 2.4MB
- SHA256 41e0925f123a94720a901fc25aaa5de76465b476f1f6118b5bb3bb1bd6d91645
- MD5 34c65e07965db6eae03de8937d03c110
- SHA1 005fe0f26fbaa675af11c00c787661258668352f
- SHA512 1f3475e3e98d524e2ae3085f6505b515c699a2b582188df01620f08739eff263a5284b38e9c35857eddb377095828cd0ab99656cd56c43b3f3bce9decc3af95b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKw/LaERaFZe0p4Ek4niOkl/A04szE87P:A3k03kHRJ1eW4SkZP4sz9Mbd56rimWDO
- TLSH T18FC54A16F6B847A6D07BC078C5D69A56FA323C461F3087CB03449B283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 361603b0bbae29f308e6f34de5b3bbbd6b8f2251c0aa400995824b1924010aeb
- MD5 17f463dee5f89e2d77a59829398222d4
- SHA1 88d83b35082331aec432049e12088a9a65e70137
- SHA512 3ec04360a193ec90943957388a3730373c554cc690130f5e0018c55fd72f94a23de650bea024319001bb99a9c1e55c628b671ebeeffff78be8a9a3384c95afe7
- SSDEEP 49152:A3k03kHRJ1eW4SkZP4sz9Mbd56rTPji0Aj:A3k03kHRDfkZcerLjo
- TLSH T160C53A16F6784762D077C0B9C5D6AA5AFA3238451F308BCB0345DB283F277D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 1.9MB
- SHA256 ed378b351b9bd8557fe1a4a8aab5f8063a0cd6983a49fc0fdda04e54068f43f1
- MD5 8f604351968b88abe731423f4d87a1e3
- SHA1 5412e651790bf91ed6ddd86f20b0c6d1f00869be
- SHA512 c90c67da91a95e8f19ac088d8e388e0f873970c8b70f59c9ab1fea45f3114aba25cf7e3ea70439fa2804fe3b927196c3cb6526738a76b52ea5c463fadc7f30fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKw/LaERaFZe0p4Ek4niOkl/A04szE87e:A3k03kHRJ1eW4SkZP4sz9Mbd56rG
- TLSH T15F953916F6784B62D07BC079C5D6AA56FA323C465F3087CB03459B283F277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH