Analysis
- max time kernel
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:13
Behavioral task
behavioral1
Sample
2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 986KB
- Sample260807-sly2wsfr2v
- SHA256 1dd0fe86c90ae80608b2ef204454ff96ab244ff0ccd55abd7ed309ba6a39a1bc
- MD5 df86606e0e2639821f471f609862d2d5
- SHA1 c132e0f360eb8c334d6d8ae3e21500662c1d56ab
- SHA512 4c2b7a000a1c53febd12768916827bee31324279cdd7e317e8b283f6064a7e23b2870fb42e52e755521a77ac24316e77f509addcb25ed0914dec4acbb0b8a1c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFBY:A3k03kB56rO
- TLSH T101258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/3672-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3672-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4104-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a59d-998.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a728-996.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8d4-1330.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-333.dat aspack_v212_v242 behavioral2/files/0x000400000001a59d-998.dat aspack_v212_v242 behavioral2/files/0x000300000001a728-996.dat aspack_v212_v242 behavioral2/files/0x000200000001b8d4-1330.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4104 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3672 2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4104 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_df86606e0e2639821f471f609862d2d5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3672
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 986KB
- SHA256 1dd0fe86c90ae80608b2ef204454ff96ab244ff0ccd55abd7ed309ba6a39a1bc
- MD5 df86606e0e2639821f471f609862d2d5
- SHA1 c132e0f360eb8c334d6d8ae3e21500662c1d56ab
- SHA512 4c2b7a000a1c53febd12768916827bee31324279cdd7e317e8b283f6064a7e23b2870fb42e52e755521a77ac24316e77f509addcb25ed0914dec4acbb0b8a1c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFBY:A3k03kB56rO
- TLSH T101258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 c4734b20bd25fa8c3f5d294291c7b2dbcfb51111773d4a89839dad4db745e2b9
- MD5 cc5142943cd191078c5375527123a25c
- SHA1 a284a516b66245e55f02f7c11f53cbb5937f565b
- SHA512 daf24715a759e70a28812fef2d90e429081f36bfc90d3e847c134e78c59f4abe86dd6b5cf866af8d663db8b5504e265a6da750e94227979028713590879ed1ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFBg0Le5ji0hmxNrM:A3k03kB56r+Pji0Aj
- TLSH T11E755B16F6A44BA5D02FC074C5D2966AEA733C425F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 1010KB
- SHA256 35a6d6bfe95889b246dc823aa61f12213ab78f86f8278d253cf91b3928e50dfc
- MD5 3b5cec8381b6ea2888f3e4198d867bee
- SHA1 8768d3b7aead3130955b0aa50cf431bcaf8c96e5
- SHA512 1f7b75f982c7bf4e5b2d6b517ac1a25a9eeee1ee689c3811711070dc4f36871258ceeb29ff2ba95869536615b33efac077f7ccfd67a9301b256eb8091be3d5ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFBMf:A3k03kB56r+
- TLSH T104258C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 1.0MB
- SHA256 d3fd104b836ea8449a9968457f37549c19d0dcce2131ccd871c71ccdaa302161
- MD5 e6c7c7c4027822804c7cf7d6926bc01e
- SHA1 801dcfae4f87e21572dc2d572251ad3350b43839
- SHA512 e9eb6be2ea4cd30ddf7fa5eed301c2257465f57ed6718b45f10411db3c004a30b8ff5a3db67946caff3c81cc6b778de033681baab1a7a9219e9f97172932e6df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFBZkUl:A3k03kB56rX
- TLSH T146356A03A6940FE8D50F81709A958672EA777C025F6093DF2358BE153F72BC06B3A697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$
- Size 1.1MB
- SHA256 e28908a19a24a0cd29f63d5951e8e600a8a9d6a925cb88c2234ea5108c62f8b2
- MD5 60724de41eb38901146bba8aadf718a9
- SHA1 5644e2ade49725f990c7bec97af35b19e5c8e9f3
- SHA512 6ddd21f3aa8c6a6cf9650583734abe58b71c89fca9b065e9479da7941b336b33701a7651861b6cb057a9c268e5cc737ada26270b26aa95afd4d7fb087874e32f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFBudSKelZ:A3k03kB56rMdSZ
- TLSH T174456A03A6940EE5D10F81749A958672EB737C525F2093DF2358EE193F72BC06E3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
- Size 1.1MB
- SHA256 9fce3bd2086f993629e199964ad324d2959fef62e52fc04c4f9ac6be1dc49f99
- MD5 fc29e3f35a8adc30cba5287730fc46a2
- SHA1 413a4d3c9f4511860bf51aa267bbe00ab18c0d0b
- SHA512 d4a3145078e9a9ee207e347da32a17c7994e7fbf32169d37764f5e09fb4080f0066e29a6bff89db1ea37050d016382bf16e196b794f532254a43ff05857aee27
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFB/T6mpR:A3k03kB56rhTPpR
- TLSH T125457C03E6940FA5D11F8130A9A68662EA737C565F6093CF2358BE153F727C06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH