Analysis
- max time kernel
109s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:22
Behavioral task
behavioral1
Sample
2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.0MB
- Sample260809-w1cc8abp5v
- SHA256 9e18f2d056cabee26ba3379bad7aac89a023a708abd9d59e440d71fb1ef1e425
- MD5 9ac482e3a2722d17fb7827c72675fe51
- SHA1 5fd59204f16ad63b68b1f1ee724f6e2be6535cee
- SHA512 03a4781a6aae0f145da21baf08a371a7dae81d1f1d1ceb2c4af49f51e1655fd507001db71df6a05a360847c405e21e5cae821a13fd5c3816c09057ec094fe20a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz6eYTqMi8CtBd2QHCHmTBW56wyCnG:A3k03kHRJ9qJtb2IfDZqrKV
- TLSH T1D2A56B16F7A442E5D067C178C6E296B6FA7278421B3097CB1349D32D2F237E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5092-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5ae-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5092-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3000-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019971-522.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9b-1268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000019c9c-1319.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5ae-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019971-522.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9b-1268.dat aspack_v212_v242 behavioral2/files/0x000b000000019c9c-1319.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3000 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5092 2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 3000 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9ac482e3a2722d17fb7827c72675fe51_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5092
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 9e18f2d056cabee26ba3379bad7aac89a023a708abd9d59e440d71fb1ef1e425
- MD5 9ac482e3a2722d17fb7827c72675fe51
- SHA1 5fd59204f16ad63b68b1f1ee724f6e2be6535cee
- SHA512 03a4781a6aae0f145da21baf08a371a7dae81d1f1d1ceb2c4af49f51e1655fd507001db71df6a05a360847c405e21e5cae821a13fd5c3816c09057ec094fe20a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz6eYTqMi8CtBd2QHCHmTBW56wyCnG:A3k03kHRJ9qJtb2IfDZqrKV
- TLSH T1D2A56B16F7A442E5D067C178C6E296B6FA7278421B3097CB1349D32D2F237E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 c7f460b603b88c3fdfee41232add37f3a55ba14127a03b6ce2e40128b74c0b28
- MD5 1298c2584b26b284f1142bd9230d9d63
- SHA1 470bc555b511122ce36b1f904517fc7936308f08
- SHA512 ac5b6a831349427088b1d85645748a38b51d7f2b05472a1d3af3f06bf4d9bc51beeb9c93d5a686fd584eabfbb1f42f7a277d3c45adcc1d1962952eed9ad4d60c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz6eYTqMi8CtBd2QHCHmTBW56wyCnq:A3k03kHRJ9qJtb2IfDZqrKRPji0Aj
- TLSH T11AC55B16F6A483B5D073C079C5E296BAFA7234821B3086CB5345D72D2F277E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 2.0MB
- SHA256 e4a73fee6027d51aaa89356118212af1d62da654c40a644844de637a755a62dc
- MD5 7cf95702981e197568cf3db5dc9f6612
- SHA1 7dc04fb58c1dceb2cf7899bd3d2170443f19235d
- SHA512 326d54b736f66e5a25413cad2d881e80de158bd7120988eddc34129badca647647643c7ad46391f49eb9b8d32fcec1384e48cfbc39b118e78087fcb175bbc599
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz6eYTqMi8CtBd2QHCHmTBW56wyCnO:A3k03kHRJ9qJtb2IfDZqrKb
- TLSH T1BEA56B16F7A442E5E067C174C6E296B6FA7278421B3097CB1349D32D2F237E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.1MB
- SHA256 01d4137d64ea6b5057cb944df55af9b6d41ffbf8d4c910cd4626d5af5817435f
- MD5 9bbd029509ed247ceb00ec1516d9b13a
- SHA1 a41fb4c25b3b8d1bd4f21b6878c5dc1770a9e712
- SHA512 3847bf89b59f54a8a08d53de588d628479e4b43cbd747d1deb48c63e3758030177788dd178e161d3b80bb4303b0a3df8ea76f81a10c2ab82d61a6cbdfe3dda3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz6eYTqMi8CtBd2QHCHmTBW56wyCn+:A3k03kHRJ9qJtb2IfDZqrKT
- TLSH T1C5A56B16E6A442A1D067C174C9E69676FA727C821B3096DF1345F32D2F337E1AE3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\nmhproxy.exe$
- Size 2.6MB
- SHA256 866a6b782b4697cb5316103f8d9ba1dd9c9b3c3e39946b7eeef809652da23768
- MD5 cbab504a3989764849b77a8d9900b800
- SHA1 907a5d658cf58e24e0dfdb72a2c8a252d2e0806d
- SHA512 0dd857dea8089a842dcb44286d4ca3e96b3795d501badcf94d0656f493c9c02c567d00593ed94e7ecb273b961bb2bf54b72a2cbaa1628728b69e72cfde5210d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz6eYTqMi8CtBd2QHCHmTBW56wyCnM:A3k03kHRJ9qJtb2IfDZqrKtdNXhn42
- TLSH T16BC57C16FBA486E5D027C074C6D68676FA3278860B3096DF1394D72D2F277E19E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH