Analysis
- max time kernel
117s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 14:02
Behavioral task
behavioral1
Sample
2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260804-rb4c7ascnd
- SHA256 c2382163ec82842ae66b2f6ea8f3e8bedaa26de842601ccc44f7681f3350c35f
- MD5 d364f321d316277917d00394f6c719d8
- SHA1 32ecbc974913a1085a18a6ab5bb6e3d74c4001c9
- SHA512 0883e1b56fa4f8abf3beecfe1a5588349b6a27f3854d086b1def344367d74081eb68d3ebd3234f8d071e98efa5ff520f5f3fb91b57bc6b332831d30ecf25dd17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEE:A3k03kHRJd56r
- TLSH T190456B03E6940FE4D15F81749AA64A62EA737C125F2097CF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2836-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5ae-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2836-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3372-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-420.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x003d000000000441-439.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00260000000198f9-700.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5ae-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-420.dat aspack_v212_v242 behavioral2/files/0x003d000000000441-439.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-438.dat aspack_v212_v242 behavioral2/files/0x00260000000198f9-700.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3372 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2836 2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3372 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d364f321d316277917d00394f6c719d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2836
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 c2382163ec82842ae66b2f6ea8f3e8bedaa26de842601ccc44f7681f3350c35f
- MD5 d364f321d316277917d00394f6c719d8
- SHA1 32ecbc974913a1085a18a6ab5bb6e3d74c4001c9
- SHA512 0883e1b56fa4f8abf3beecfe1a5588349b6a27f3854d086b1def344367d74081eb68d3ebd3234f8d071e98efa5ff520f5f3fb91b57bc6b332831d30ecf25dd17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEE:A3k03kHRJd56r
- TLSH T190456B03E6940FE4D15F81749AA64A62EA737C125F2097CF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 c489055e6eb8f818ca2c182b91682b213ef01166843e7fc51ffe1e10aa749c95
- MD5 db7ad07a4c05b531ad039f17c14d2394
- SHA1 37dd615aaaf343aacd39f3638320697d06ae29f6
- SHA512 253e5a34a5a676f1382fff2a6a7995ffed80ea9f6ba0486b714c8d110fac38fdd8a8ffecb617572ac8d229528128ed1fdbcd4f77b2fd3b870fcbdb9f8626fd71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEEP0Le5ji0hmxe:A3k03kHRJd56rOPji0Aj
- TLSH T101855B16F6A44BA5D06BC178C5D29656EA733C421F3087CB1354EE283F33BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 1.1MB
- SHA256 3246d588b56de879fd092984680e179293e1f81e4861bc93c14339ac3eebd490
- MD5 d9829dd57c98222ab282bb655fbadf02
- SHA1 d5a8cd97819bedb87cdcc112774186d86dbe7fc9
- SHA512 11b1b23d53925c98154e3af4ace5c2548007c01b37cbfed643122567c6f728bee48e44beb816c7cd6bf19a79ec5e2c2852d0ba670626f2dd8dda615127a459c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEEUo:A3k03kHRJd56rA
- TLSH T17A456B03E6940FE4D11F81749AA64A62EA777C125F2097CF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 1.1MB
- SHA256 d3baf3eb63e8dc007b51db53836c8545ca47cc04bb5797e2cc8252abb4e0a632
- MD5 0b1fa90c1faa7263fff979e5c1610fab
- SHA1 409c32447db56cd4fa9b37a8a920f514c7f2acb5
- SHA512 86b416c72a446b9f8ea1722a1dd3c3f4d28797c07244a2cb28f40a569d332fe4069fe4f670b3bda85e3b616eb910bcad17416ce268e9f9bc51ee0c1f2542d204
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEENQ:A3k03kHRJd56rl
- TLSH T1F6456B03E6940FE4D11F81749AA64A62EA777C125F2097CF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
- Size 1.1MB
- SHA256 4be141ae9e063b14c10dc19e7a61f1e4cea7823321f53db894e3a2bba948a816
- MD5 9fa76f74a35d30a6e9ff2afcda237880
- SHA1 a626ee67235b362eb8ab9a91def61d6731dcbbea
- SHA512 dc1305d4fb523a4edce3e5cf0908ef1c514dc8a6d29e2c141bab122dabe3ce301c7f145586a2c1f4a7eda27616b6e088a14aaba6aea60758f484bd81949f93e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEE3+:A3k03kHRJd56rt
- TLSH T13A456B03E6940FE4D11F81749AA64A62EA777C125F2097CF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 1.1MB
- SHA256 67fa0f9724335437b6080c5f0e53e8ef31042ade70638a59f6ac659b82fee565
- MD5 e0217e309fa5bd19d154666b23d81680
- SHA1 064741345ccf2296c7c415f76cb8aae8bf7ec3d2
- SHA512 8a283b7d7265ef377033c7a35b9c46db98f05c54a398451aee4bb70f2e58c7160926dec697b89edbc6741934ebbdc6bba6dd248e8fc2a4e2b6105da93062fc5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJbaRaMD5TvinrmbEEyC:A3k03kHRJd56r0
- TLSH T11C456B03E6940FE4D11F81749AA64A62EA777C125F2097CF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH