Analysis
- max time kernel
62s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 09:21
Behavioral task
behavioral1
Sample
2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.8MB
- Sample260804-lbmgsastct
- SHA256 d96f89a859e411ba241d9016abc0572dd936b04d4f0a627124533a3d965248e2
- MD5 dd11922d3c6e02fa433d33bae840c0f7
- SHA1 8e15e4b1b38a2d13c6dd19f25b1ffca063332a76
- SHA512 653a982a36537b1db3e81115185ef88e7700dc0d7f9b04e6ae97d67b359cda5ad2dddd316fb9f98f29edc82aba1516458c7d553553abffb44bd51f45c53afe65
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2Ig:A3k03kCrd6YfkZckr
- TLSH T1E2D52A16F6788722D077C0B9C5D2AA9AFA323C455F308ACB0345EB282E377D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/1896-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002443f-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2408-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6da-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1896-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2408-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021226-295.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214c2-715.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022547-1183.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216a1-1287.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002443f-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e6da-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021226-295.dat aspack_v212_v242 behavioral1/files/0x00020000000214c2-715.dat aspack_v212_v242 behavioral1/files/0x0002000000022547-1183.dat aspack_v212_v242 behavioral1/files/0x00030000000216a1-1287.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2408 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1896 2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2408 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd11922d3c6e02fa433d33bae840c0f7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1896
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.8MB
- SHA256 d96f89a859e411ba241d9016abc0572dd936b04d4f0a627124533a3d965248e2
- MD5 dd11922d3c6e02fa433d33bae840c0f7
- SHA1 8e15e4b1b38a2d13c6dd19f25b1ffca063332a76
- SHA512 653a982a36537b1db3e81115185ef88e7700dc0d7f9b04e6ae97d67b359cda5ad2dddd316fb9f98f29edc82aba1516458c7d553553abffb44bd51f45c53afe65
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2Ig:A3k03kCrd6YfkZckr
- TLSH T1E2D52A16F6788722D077C0B9C5D2AA9AFA323C455F308ACB0345EB282E377D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 632443c1ef908448d48df4188ac12db7c26580361537610cbd7b92f36400f998
- MD5 797ae209c24401c19091da11ed7a7371
- SHA1 2923d087b9dc5f2023bce084d13eca8cebb98dfd
- SHA512 46c60f82023ef53efbd2106dc70b892c3cc480b3602d7f9110a7162dc6634d47123ac79341cfe5ed26f84c0c36b50926dd3a1238ee23d32794e244d47c895f1f
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2I4Pji0Aj:A3k03kCrd6YfkZckfjo
- TLSH T1CCF51A16F6788722D077C0B9C5D2AA9AFA323C455F308ACB0245E7683E377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 2.9MB
- SHA256 0f8918c8bcd116f279d21a63898662c2b28af44c48e85cd21c845ded1fca42b6
- MD5 aed395670e795cbd5af13f997ab05489
- SHA1 d40ff4712ad9342452d081f5318d9833d8618fdf
- SHA512 caa4016c06a610e9eb5182b5a2b67c23269bea99f4735f1f1fcecb9f35385f41c8a84201b4c97cacef19690972cb09132c556e3ad3d3c5865823bf09efa7cb0d
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2If:A3k03kCrd6YfkZckG
- TLSH T186D52A16F6788722D077C0B9C5D2AA9AFA323C455F308ACB0345EB282E377D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 2.9MB
- SHA256 aca49e283bb5e1a9f52608f61d13a885825221b06166d38eafe8a383b56b5b3a
- MD5 b1ebac68c75790712adae0db21b8a323
- SHA1 80ec9fc0ca50fa527ad4b6b1d0ee3b33caee4aa0
- SHA512 f8b3635d07283d2258af638b3565450b61e3bc5fad6c32c6784ad55c63416c448076ede9592ad7d8ffb4c8252888a0773e771a1a6624dbd53a0ea6f64e04c441
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2I0:A3k03kCrd6YfkZck1
- TLSH T12DD52A16F6788722D077C0B9C5D2AA9AFA323C455F308ACB0345EB282E377D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.9MB
- SHA256 0d20edccf5746bcb8dc4e6cd99fc5bd760c04b87c4d7159d646a44c2aee321ed
- MD5 00c0c542b5d3a5e15a3a7dc0d903dd72
- SHA1 7ab7dc0674743a3c3efca50ed27e26a86eb0f73d
- SHA512 4021392d9aab5ddf3ec6f64954fb41625b4aced84500ad2fa68db88246ae159d3c312dc631f51ae7e581d2a3b415efd937f8be3828af4b8cd7c3ad5a4b604caf
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2I4:A3k03kCrd6YfkZckJ
- TLSH T1B0E52A16F6B88722D0B7C075C9D6AA9AF9323C411F308ADB0245FB282E377D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe
- Size 3.7MB
- SHA256 f71458eae41046bcf64c509bea9383be61616f739347127bdd76fcf082e46749
- MD5 0815897f1bc40ee62d7bdee2cc4534ec
- SHA1 ef949c02344bbe4d30a6cedeeb0f211930c25ce9
- SHA512 9c78883b154eedaf85e89929143e997b824318c7149f32d26bbcaad00f59f085d8c0a3dbc2b3f2b927d1e48ae73fe4202a66ae409234916a06dd96f3eac8b7a8
- SSDEEP 49152:A3k03kB56rdpYqLeW4SkZP4sz9MbkqJtb2IX:A3k03kCrd6YfkZckq
- TLSH T1EE06F411E5688722DC6E8C75C582A675F9323C8F7F2CBACB0E45B7282E376D19535322
- MD5 SHA1 SHA512 SSDEEP TLSH