Analysis
- max time kernel
92s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 08:24
Behavioral task
behavioral1
Sample
2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.8MB
- Sample260804-kaqmdaar71
- SHA256 1ff8a8c0cfd06003e2fe3729f5ccbffacc134ed360e83ce778f743a890b88393
- MD5 0f00f6f477f37a135231bb1855d1466a
- SHA1 3fb170089543e9969d63ea1b8c3fcac25ca9fce0
- SHA512 d981cddba4591be42ef6fc68d75c4d795c108c1048094b47b2b9de29f5b5561dc32c4cb2a09e16d87c199f0d92cae009f861572c066c0c44427bf222543da733
- SSDEEP 49152:A3k03kHRJR56r/56r+qJtb2I756rrqJtb2I:A3k03kHRcrAr+vrr
- TLSH T18DD51816F6A84F65D06FC074C9929696EA333C425F2087CB1355BF293E336D1A93A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4852-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3908-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024438-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4852-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3908-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021650-1288.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000020368-1628.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000016918-1960.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024438-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0003000000021650-1288.dat aspack_v212_v242 behavioral1/files/0x0002000000020368-1628.dat aspack_v212_v242 behavioral1/files/0x0010000000016918-1960.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3908 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\RequestClear.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4852 2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3908 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_0f00f6f477f37a135231bb1855d1466a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4852
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.8MB
- SHA256 1ff8a8c0cfd06003e2fe3729f5ccbffacc134ed360e83ce778f743a890b88393
- MD5 0f00f6f477f37a135231bb1855d1466a
- SHA1 3fb170089543e9969d63ea1b8c3fcac25ca9fce0
- SHA512 d981cddba4591be42ef6fc68d75c4d795c108c1048094b47b2b9de29f5b5561dc32c4cb2a09e16d87c199f0d92cae009f861572c066c0c44427bf222543da733
- SSDEEP 49152:A3k03kHRJR56r/56r+qJtb2I756rrqJtb2I:A3k03kHRcrAr+vrr
- TLSH T18DD51816F6A84F65D06FC074C9929696EA333C425F2087CB1355BF293E336D1A93A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$
- Size 2.9MB
- SHA256 119369e400801e6eecc2d937b1e02a90d011110c22f0055549645e644e280152
- MD5 95cb6022e30548d8d1a5a33f377db511
- SHA1 5d2a8f04785e0ded3ae77f9aa1db43003c0154ae
- SHA512 465963980f8e1dd7739cf0f573d2102628d1c9c7fd0f9578db6b8b7fdbddc273341475a3a1989a25ccf3eed8f70081d2ec01ce09394933b31fbdb31ac8e73f78
- SSDEEP 49152:A3k03kHRJR56r/56r+qJtb2I756rrqJtb2IyI:A3k03kHRcrAr+vrr3I
- TLSH T10EE52916F6A84F65D06FC074C9929656EA333C425F208BCB1355BF293E336D1A93A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 2.9MB
- SHA256 684df12e11bd3f1f1dc0ed96956684587d117965a7e52942aedaa53213204b2f
- MD5 b855dc5812ab9eb0c6620dcb9ca673c2
- SHA1 48aa0a754710dcfaa64256fb4f42cd48e9c78170
- SHA512 5dcf73d06d6788900c2484afbe7ed46bdaff6c6d4a6f7f0b7bdb29df386f4bab7997c38f97c78ef049e5a6ad9bc594431474924fe72fb19b9ef63435b03c13b8
- SSDEEP 49152:A3k03kHRJR56r/56r+qJtb2I756rrqJtb2Imw:A3k03kHRcrAr+vrrE
- TLSH T14DE52916F6A84F65D06FC074C9929656EA333C425F208BCB1355BF293E336D1A93A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 178516ba2b7c97bfde2e541df374a1b66132eb2afa39c4e2a33f7366395b1362
- MD5 cd1b02499ce021d3693367edb158eee9
- SHA1 0f5576f97624c1900ebd84eab18c8ed118817dbb
- SHA512 d54e272a1a53e28869f3ea12574f24f259568570e7fadf7dc7119ff5d76efe8fb00e44594f2a18b9cb9cb8afc1cfa369f26b57ae5fdc90bd2fcb3c3a38acdd38
- SSDEEP 49152:A3k03kHRJR56r/56r+qJtb2I756rrqJtb2IQPji0Aj:A3k03kHRcrAr+vrrZjo
- TLSH T177F52916F6A84B65D06BC074C5D2969AEA333C425F308BCB1345BF293E376D1993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.9MB
- SHA256 1e554899ae4b3d5b432d7bb90eacb8a0f5b58714bd6e00c549ae8ad84429024c
- MD5 01c85afd14f8d59394e7e5c4cc6f92c0
- SHA1 2732b903ee7bc46c7764cab25606498bedaffab1
- SHA512 6a7bee51497a6b6ef506fa3046793275fdbc408da24c0005c4b95f159ac15e3d7556d968956290df7153c9d8bfebb2bd0cc276f8d6387457cf162c354f5f35cd
- SSDEEP 49152:A3k03kHRJR56r/56r+qJtb2I756rrqJtb2Ig:A3k03kHRcrAr+vrrr
- TLSH T1A5D52916F6A84F65D06FC074C9929656EA333C424F208BDB1355BF293E336D1A93A723
- MD5 SHA1 SHA512 SSDEEP TLSH