Analysis
- max time kernel
71s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 14:18
Behavioral task
behavioral1
Sample
2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.2MB
- Sample260807-rmpdeazwbt
- SHA256 7c150d354b5ca5b6c87ea666b35beefb600addf4c71744b632951fc431b42256
- MD5 2b6e86eee3e570499387d96f9d87c253
- SHA1 6e3eadd939f10d96d99d5f57f8bab3a5321408b9
- SHA512 34d47c1e2886c9d2f965adb243b7ba49e2868b8d71c57ea8d1cb8e843ac7c54ce1e66ba0710e90ab2803bba26e874d25671a36f36aab71b90ce6be802ae9d877
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgG:A3k03kB56rN56r
- TLSH T179456A02E6980FA4D65F8134DE968662E6737C425F2097EF1354BF253F327C0AA3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4788-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233b2-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5600-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4788-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5600-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023671-121.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00170000000219d9-1271.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a000000020242-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024607-1753.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00020000000233b2-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023671-121.dat aspack_v212_v242 behavioral1/files/0x00170000000219d9-1271.dat aspack_v212_v242 behavioral1/files/0x000a000000020242-1378.dat aspack_v212_v242 behavioral1/files/0x0007000000024607-1753.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5600 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4788 2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5600 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_2b6e86eee3e570499387d96f9d87c253_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4788
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 7c150d354b5ca5b6c87ea666b35beefb600addf4c71744b632951fc431b42256
- MD5 2b6e86eee3e570499387d96f9d87c253
- SHA1 6e3eadd939f10d96d99d5f57f8bab3a5321408b9
- SHA512 34d47c1e2886c9d2f965adb243b7ba49e2868b8d71c57ea8d1cb8e843ac7c54ce1e66ba0710e90ab2803bba26e874d25671a36f36aab71b90ce6be802ae9d877
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgG:A3k03kB56rN56r
- TLSH T179456A02E6980FA4D65F8134DE968662E6737C425F2097EF1354BF253F327C0AA3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.5MB
- SHA256 ec8eff9e2b285b56e416c616a93676dd6416efd4d1d79494181f55e6c02cd120
- MD5 5ccaf6dbb2ff47a2ad8c978cd129f04f
- SHA1 bf41e6c5fca43c594718b48b51980c859bd692fb
- SHA512 c76055d1ec76941aebd613c4834b97b06ab4fae9ae1b6c004d6a81981df467b1dcfa621357e46301555165320045cc246b294767d4e2df539c76468ea6113c06
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgGF3UNUpEisI:A3k03kB56rN56rKUN+Eir
- TLSH T198754A16AA984FE5D51F91348D968661F673BC510F2087CB1354BF2A3F336D0AE3A263
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.3MB
- SHA256 173a92433cc1fcd003ece86d922586b9243787df818e8b317017f0368bd25ca9
- MD5 ef52114b37214731d1fb57937476ccde
- SHA1 04dcad4b9b8069a5f750e82d982a6c40abc50291
- SHA512 77bd2207c0214b7f9e0e542a0ff1e79f0b4273b4b12932b5757ca09539e0e17026a38b96359b687c4497d72293dc0e6847b7d01e25ad6cea71395da5b2947359
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgGhTjE:A3k03kB56rN56rgw
- TLSH T1BB555A02A6980FA4D25F8134C9964662E7737C525F209BEF1364BF253F327C0AE3A657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 1d8fee571efe71dd4ce8160feb1a793b567ddb64ca7fb60669e5868e50e9d6d2
- MD5 24a5d001075cf8c6dfe1ddf4f885b99b
- SHA1 d7879b5a3cdbfd4cf4210c12a628c587ce00a245
- SHA512 87d09393a3f0da5ffad374e3277d8cc9faa4c5a94c908cf607e5d53372301674ccff9fa1f620dd51ee5dfd9c6140b3e4969566b599c2624cd1e6dcaf114e11b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgGP0Le5ji0hmxNrM:A3k03kB56rN56riPji0Aj
- TLSH T14A853916E6A44F65D06FC074C9929666EA733C421F2087DB1354BF293F336D1AA3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
- Size 1.3MB
- SHA256 ffb7a53093ee206aa94dbc0ee92e9d2c5cf6ce9910f3cd9c4dce5902e30ff1d1
- MD5 58029fe58676f61ac8a340ad8490e5c3
- SHA1 9269ab559bcf45bf29c8d066d1e7e7501e94c06e
- SHA512 732232caf2ca3338fa898827da24e1722e4bb0b9217697c61caf840e237441a991541f5da278247d198f523e239bf6812b8504af627647ad7f40e1f68d8dd317
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgGkD:A3k03kB56rN56rf
- TLSH T13E55F406E6980FA4D15F8134CB964662F6337C524FA097DB13D4FE3D3F32680AAA9653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.3MB
- SHA256 90fa47f130f29c5547e8f77123268b57f306043b982fba046a348013da727878
- MD5 3272455c9f5cf8d5687fb3b66063b104
- SHA1 28a4f2f8cd5be0b6df7f6529f6447ccf10ba5d6d
- SHA512 8e6344eefa43fb30f3505aa537966b6e8bc85cc69d43f6a08a8e076ca35a25b4a0a2a98b9a5466b7d307712e2fa9b1a5e3b528156594b4f9cf74b69b6817fc3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkEzD5TvinrmgGLF:A3k03kB56rN56ry
- TLSH T101554902E6990FA5D64F8130DD968662E6377D810F209BEF1364BF253F326C0BA39657
- MD5 SHA1 SHA512 SSDEEP TLSH