Analysis
- max time kernel
105s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 21:57
Behavioral task
behavioral1
Sample
2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.4MB
- Sample260810-1vbxqaal8v
- SHA256 da2c13f5335a839213c9ee83c523bb809129056039e19b7455668420a28c172e
- MD5 ad44f6567fc5c7b298af3007481d4bfc
- SHA1 0e481810aa0d514425b9c8a72bf87262fc90e2e2
- SHA512 6d67f07af2b3fd32c5cdb8727236c03e286c1d78a230b68236275325ddb86f500d0a6aa87ad8e8c853ecd4372e2aecab33abccf15fba8321f845abd0671490f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagC+XZe0p4Ek4niOkl/A04szE87Jl:A3k03kHRJJeW4SkZP4sz9MbE56rapYq
- TLSH T165B53A16F6788762D077C0B9C5D2AA5AFA3238455F308BCB0345DB283F277D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/3316-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b871-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3316-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3420-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd3-677.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac38-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000188be-1272.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b871-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd3-677.dat aspack_v212_v242 behavioral2/files/0x000300000001ac38-1175.dat aspack_v212_v242 behavioral2/files/0x00190000000188be-1272.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3420 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3316 2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3420 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ad44f6567fc5c7b298af3007481d4bfc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3316
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 da2c13f5335a839213c9ee83c523bb809129056039e19b7455668420a28c172e
- MD5 ad44f6567fc5c7b298af3007481d4bfc
- SHA1 0e481810aa0d514425b9c8a72bf87262fc90e2e2
- SHA512 6d67f07af2b3fd32c5cdb8727236c03e286c1d78a230b68236275325ddb86f500d0a6aa87ad8e8c853ecd4372e2aecab33abccf15fba8321f845abd0671490f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagC+XZe0p4Ek4niOkl/A04szE87Jl:A3k03kHRJJeW4SkZP4sz9MbE56rapYq
- TLSH T165B53A16F6788762D077C0B9C5D2AA5AFA3238455F308BCB0345DB283F277D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 e6e5498791d7be34ea48630f8febf8ed2c309fc05945314668945125401a1b83
- MD5 c4902f765fe086f2525e729f45ab26c2
- SHA1 ab2b66c0293f1b1b3f7fe8ac891f6ac4de563fcc
- SHA512 063bdb3a5fed76eae610e641fd050eebaf6b15b9d1901207ae6c1e180e52f0a3fb6ec9708d30098003f7168d14cffda7ef1b48a5e790232d7fd7be3ae492edb0
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbE56rapYqjPji0Aj:A3k03kHRXfkZcBra6Gjo
- TLSH T1E2E52A16F6784762D077C0B9C5D2A69AFA3238451F308ACB0345DB283F277D59A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 2.4MB
- SHA256 ca4ce8b0ad2511f2c7cec820058ee0d28a5da2c105f2298b02bc090c016806f6
- MD5 39d5ae5a4aae6e9e82e7eeec714340d2
- SHA1 f724a402bbacb71dc6a5d707a76ed71c12dc26dd
- SHA512 25e03155cc68378364293b49906fd8b3f007a444d24d45920c237e81f0e06f397a90ca8c488685ea3421be86d7b4c77254d376ed9c00cf5c6ff9c1a82389d8cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagC+XZe0p4Ek4niOkl/A04szE87JH:A3k03kHRJJeW4SkZP4sz9MbE56rapYqp
- TLSH T168C53A16F6788762D077C0B9C5D2AA5AFA3238455F308BCB0345DB283F277D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.4MB
- SHA256 f11374580294b56b107f51bf5a99a78d99c7d64cf09938813b4fa6550e3ff948
- MD5 350976673a21f96407d9e53fd15046f7
- SHA1 97323a7fd17cb0a8f73cca27f307ed07e5fd28e2
- SHA512 fe4176bc6afd6ece9a1b59dca0e9ae9a5c425cf03f553ec315610911b0abc3fee36a2f837e9f368dd9b31265aeb2c491c8973f5931e928a7e48c4822fb730842
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagC+XZe0p4Ek4niOkl/A04szE87JP:A3k03kHRJJeW4SkZP4sz9MbE56rapYqt
- TLSH T106C52916F6784762D077C079C9D6AA5AFA323C450F308BCB0345AB283E377D59A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 2.4MB
- SHA256 ba3991dffddacd82b8ae17f03f3f8567a56528c2bd68af797c65c9ee9e91d6c8
- MD5 130738d6a2b2bbdfbf97b882db82d856
- SHA1 b047d2e8d188b6259ccb6d9ea3ab063ade343a4f
- SHA512 0bb2ebbfc93f62a8ecb4be2d2b7e9bf74586005702765cee4af50cb544df7474893c57aae3bc4a820b244b08b71c8c71384e5d44fcdf68c2c4ae8365a988866f
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbE56rapYqw+:A3k03kHRXfkZcBra6u
- TLSH T1CCC53A16F6788762D077C0B9C5D2AA5AFA3238461F3087CB0345DB283F277D59A39726
- MD5 SHA1 SHA512 SSDEEP TLSH