Analysis
- max time kernel
80s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 15:53
Behavioral task
behavioral1
Sample
2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.5MB
- Sample260809-tb2kps1dlf
- SHA256 f74ea5fc9ce7f9719ddb748fa6dcf2a8bdd3eabbf531a862bea1728ae66fdaa3
- MD5 d95fc3a2b0cc44f8c5d32b19cd750e0d
- SHA1 d161cada78a6e56d5194ecef6df48688af601363
- SHA512 b6a258d45ac07df416fa1d443a211a8248fb211077d83b586614b818de3b3c555c12a0a244d0c45f8b59d839ed9be44ac47803a40fcf528e0d2bf7c78243adda
- SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYq:A3k03kHR+Rg6cJr0fkZcO6
- TLSH T174F51916F6788762D077C0B9C5D2AA9AFA323C455F308ACB0345E7282E377D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/2296-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024670-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5024-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2296-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5024-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022669-1258.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024684-1544.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e510-2090.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024670-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x0002000000022669-1258.dat aspack_v212_v242 behavioral1/files/0x0008000000024684-1544.dat aspack_v212_v242 behavioral1/files/0x000200000001e510-2090.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5024 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2296 2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5024 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d95fc3a2b0cc44f8c5d32b19cd750e0d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2296
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5024
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.5MB
- SHA256 f74ea5fc9ce7f9719ddb748fa6dcf2a8bdd3eabbf531a862bea1728ae66fdaa3
- MD5 d95fc3a2b0cc44f8c5d32b19cd750e0d
- SHA1 d161cada78a6e56d5194ecef6df48688af601363
- SHA512 b6a258d45ac07df416fa1d443a211a8248fb211077d83b586614b818de3b3c555c12a0a244d0c45f8b59d839ed9be44ac47803a40fcf528e0d2bf7c78243adda
- SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYq:A3k03kHR+Rg6cJr0fkZcO6
- TLSH T174F51916F6788762D077C0B9C5D2AA9AFA323C455F308ACB0345E7282E377D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 4.0MB
- SHA256 39bc52348e5f1e8af05ac8401ac510f87fbefa14376c9b248b4b81b48bd5bf7e
- MD5 2c9ae3e0c80a4ea2e07e8468199c353a
- SHA1 e0986b59ad42c2b5907eb335cd3820bf360a6a1d
- SHA512 1273433d46713d5c187897a3f3d1f956c12b0018615e6f237ae293a71f09418880fe353477d0fa8d472a0cead96ba995986fa8218f5b4b5c519cf6980d7e3cfa
- SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYq+T9t2:A3k03kHR+Rg6cJr0fkZcO6L2
- TLSH T12B162A16F6788766D077C079C9D2A65AFA323C450F308BCB0345A7682F377D59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.0MB
- SHA256 efe9f0ef86c312cf9d442fb5a8e53d5e88fadc8b05170b3d5a4b8e593b47912b
- MD5 2275ffa91dfc5924799aed9cb8d5733c
- SHA1 53b5d724eeb139e3963782efdce99def18fd0691
- SHA512 0bc0c5c6c0b9b59ca5acd7c16c5b4b4baa3bd1125ae1097e9b19f7facfac399e3c3b50a7d90914a2728c7e1cd90e55ac184852b2823afaef3308936fb5e95cd0
- SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqjPji0Aj:A3k03kHR+Rg6cJr0fkZcO6Gjo
- TLSH T186162A16F6788772D073C0B9C5D2AA9AFA3238455B308ACB0345E7682F377D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 3.6MB
- SHA256 c1131399eca1add9c1b571912c728eed7b453d3c35acaf6abc6cd977c265da14
- MD5 d7471d5c7fd0ed2f35b5f9f5b58e8efc
- SHA1 6e28558bd556db01f48e36131c9a6a2e41aad57c
- SHA512 292b30f386615fd0926fca38107e0c27835f0e692f84100a9da6b1201739335a17faefe86d86412a8272f1f51e3956b7e8bd11912d1bb6ae18016d3271757be5
- SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYqt:A3k03kHR+Rg6cJr0fkZcO6Y
- TLSH T1C9061916F6788762D077C079C9D2AA9AFA323C454F308ADB0345B7282E377D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.7MB
- SHA256 c57f579d8c0986c8403b03c934ab7bceb18718ef825954726d33c2570ba2d84d
- MD5 86c5f5736f70dc18b2c993200aade17c
- SHA1 4b63b73f56fe131935ea71a4e0cce5962241527e
- SHA512 78ab8cceeea1fbebb1410c124cf1d69ce6157f173b3f7c561a19776d7c543e71fc095e248b978c149dea4c591a63e6fb2b5123998a2cc3063bb7fefb8edef741
- SSDEEP 49152:A3k03kHRJARJWpYqxqJtb2Ij56rIeW4SkZP4sz9MbOpYq/i2WH3:A3k03kHR+Rg6cJr0fkZcO6CuX
- TLSH T1D7061916F6788772D077C079C9D2AA9AFA323C454F308ACB1345A72C2E377D59936722
- MD5 SHA1 SHA512 SSDEEP TLSH