Analysis
- max time kernel
102s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 02:55
Behavioral task
behavioral1
Sample
2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 962KB
- Sample260804-deyefser51
- SHA256 ae70a7d5f38e30fc5fbe7b89f67f05efb2320e3be49e1d09c47fa919ab45f4a7
- MD5 509fa0425c692e7e97e2b8afaeaf2897
- SHA1 81680be6830888aeb6453cc07377a588e87881ff
- SHA512 61e2037dc1799cbdb0566164e22ffa13ccd7b8bc4b67fb771d9b5496b7ba9cf840a267aec184f04b980026a302668df82e2455deb1317de8e60c8ded314d312f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3aalP9:A3k03kHRJ2
- TLSH T15925AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4740-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244ef-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2524-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4740-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2524-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001b00000001e08a-1630.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000016914-1882.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e48d-2074.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244ef-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x001b00000001e08a-1630.dat aspack_v212_v242 behavioral1/files/0x0010000000016914-1882.dat aspack_v212_v242 behavioral1/files/0x000200000001e48d-2074.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2524 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4740 2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2524 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_509fa0425c692e7e97e2b8afaeaf2897_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4740
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 962KB
- SHA256 ae70a7d5f38e30fc5fbe7b89f67f05efb2320e3be49e1d09c47fa919ab45f4a7
- MD5 509fa0425c692e7e97e2b8afaeaf2897
- SHA1 81680be6830888aeb6453cc07377a588e87881ff
- SHA512 61e2037dc1799cbdb0566164e22ffa13ccd7b8bc4b67fb771d9b5496b7ba9cf840a267aec184f04b980026a302668df82e2455deb1317de8e60c8ded314d312f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3aalP9:A3k03kHRJ2
- TLSH T15925AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.0MB
- SHA256 f61f54c99cf98425bf6235e189da19e0e5537eb5ca68afc538ef950a8d8237ec
- MD5 96425c39feb02414c4c4b5de066f4617
- SHA1 c729f98111e3f50c4498059f3d3e36b6a045b3ae
- SHA512 31428a4ebee4122d2f671de6f248593e04e32cd0fea2919fd75e72ab5bdd8e8db03251212ede3bedc5759740ecc278b743862f7eec7284cd6ea715caa3cdd6f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3aalP3bBPzBAU:A3k03kHRJqBPVAU
- TLSH T19735AE03E79400E5E11AC1349AE69A23FB75BC52176097DF2358C6152F72BD0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.1MB
- SHA256 4167413cd5e4724b130c93f93da2b89d8455309ecade9211c2485c292dc531e7
- MD5 9dd0260fd6affa684cb3622fc22b0641
- SHA1 1d409e3c794ebd69abc6ecd3f6c8e734b13f6b9d
- SHA512 2bb2d0b37f4d5c6db455bd2863050373faea64095207fdeaa368ea257093147cd08820338e0d5b0866331d784153000e7d9faca40e8470e044d3fbe409e9377c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3aalP/TjE:A3k03kHRJsw
- TLSH T11A35AE03E79400E9E11AC1749AE68A23FB75BC52176097DF1368C6152F72BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 eb53fd032c52090e92a3a5c89f1602cd6cddbd69bdcf3c91d0094f611d5bed09
- MD5 cc01698f847a9f0e53f43ffba6b9fbea
- SHA1 ebc1f85880639045b5fffa3b5c2b24e54970f8cc
- SHA512 d44a16c13e7fb8b87d0b963327cb358c87c425e12c31e008e8e6c9943dc422e90129f622bef838808038f562798a76ad0516036dd549f8bbb867bf64a1a8128b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3aalPJ0Le5ji0hmxNrM:A3k03kHRJ2Pji0Aj
- TLSH T15D657C17F6A402B5D067C1B9C5E69A5AFA7138421B3086CF1398C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.2MB
- SHA256 63294a6328da3091b80d1cbec9ce1318c3051c09cf19814e663f61b8612fe019
- MD5 a5e495a14a2172f44e5e6ce4f23c9cd9
- SHA1 e0a8219142b806aac13b402889ef3091052d9285
- SHA512 47174d8bdd30f1f3011a89b162ff14ee1f30a39180e399dd1531304bf672e833eefcc942cbd73f66bdfa2171197fcecd0348f9f4e228b2de5b260005273dd6df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRape3aalPZV+PAk2hMH3:A3k03kHRJ0i2WH3
- TLSH T1EE45AE23E7D400F6D11B81345AE99636EB35BC52173192CF6358D60A2F72BD0AF3A396
- MD5 SHA1 SHA512 SSDEEP TLSH