Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe
- Size 636KB
- Sample260804-hnf9raytct
- SHA256 deddc72b04a5e79b568ab02d3d8b3569f3eadfd06d559d7873fe4a82d8a9612d
- MD5 708ffbfceaed7467e3cc80350f2ae3f3
- SHA1 1e356574243652a6a422bc49d728b93fd6274279
- SHA512 095976c0b8f44d1d2a3a3727ee264974b71c4fc0a0d495a8a132ae35fb4ee924af8cbe45d1660ecf4aecd95da2508c45f08f1b0601e925487b27887b3b2722ff
- SSDEEP 12288:kbdfG8p+xtA6AQnhEGcr21+pqaYU7SC1VOlVtB:kpu8+XzAQiGL1sqhUezV7
- TLSH T136D4F721BBE88031F5F31B30ADB986755A7ABC616F3486CF23841A1D5D74AC0DA38767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\label.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\dxdiag.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\WPDShextAutoplay.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\refsutil.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1_none_c574d8b0f950d6dd\ImagingDevices.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\r\prevhost.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\r\LaunchWinApp.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\PerceptionSimulationService.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\r\msdt.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\r\adamsync.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\r\psp.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\r\pacjsworker.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1_none_096f21018ec4c252\GameBarPresenceWriter.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.26100.1591_none_381f2a62bcc881c7\mfpmp.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmplayer.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\regedit.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\r\CheckNetIsolation.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\r\bitsadmin.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\dasHost.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\FESearchHost.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\r\verifier.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\r\repadmin.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\wermgr.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\hh.exe 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\AtBroker.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\PresentationSettings.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\msdt.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\SystemSettingsRemoveDevice.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizardElev.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_ad704d12215bf117\aspnet_regiis.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_47183375504a1255\RegSvcs.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_22beb1f66a9bdcd9\ComSvcConfig.exe- 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_708ffbfceaed7467e3cc80350f2ae3f3_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.6MB
- SHA256 32c0bd979719dcb1c16d4209cd2eef84f61e4f80874f04f958ae272c3558d6df
- MD5 3b272cd53ed0240db1f667183295cfdd
- SHA1 02108c23bd602f58b35f7eaefc817b468498d509
- SHA512 9310320e3a5c29dd02a3796e21a13b9e7b44d1e763c4b4e6549207a975c3717cebc59f8ef0d6042e16f1b8f3637db67b4c08210dd3ab1fbae629a8b7ff398164
- SSDEEP 24576:kpu8+XzAQiGL1sqhUezV9a7/ezSC6vUyD/aqgrvWx6q8wyuC:kpj+sQiGZsqZR0/ezSC6vUzPvMHjyd
- TLSH T1B5751925B6B88333E0B3D175C9E6A6A9FE7238425B3089CF1345972C2D366D1CA35736
- MD5 SHA1 SHA512 SSDEEP TLSH