Analysis
- max time kernel
90s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 23:00
Behavioral task
behavioral1
Sample
2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260810-2y6f6sbm4v
- SHA256 2756bf0caaecfe6f840b208cb48572e01803b0933dd8aa5b7bf4af292960f215
- MD5 0c661f333713feab0826b2ff5a46988c
- SHA1 a63cd7f9b5e521db6bde712d8944fadc3644bb85
- SHA512 c5c1c9515e8c81ba4fd591965c9a9fd4aeededcbab83fc58161be6bdca6c1de7efd1d659aa74d88fa69d1e9f98ae373057ed65d843b8e5853a69ffeae86be2d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlh0Le5ji0hmxNrMPGkD:A3k03kB56rQRJHPji0Aj0
- TLSH T11585F716E6A407A5D06F8074CB965656FA333C410FA087DB02D4FA3D3F366D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/3720-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024448-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2012-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3720-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2012-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021238-391.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a3-1260.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000230d1-1937.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024448-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021238-391.dat aspack_v212_v242 behavioral1/files/0x00020000000216a3-1260.dat aspack_v212_v242 behavioral1/files/0x00030000000230d1-1937.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2012 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3720 2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2012 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_0c661f333713feab0826b2ff5a46988c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3720
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 2756bf0caaecfe6f840b208cb48572e01803b0933dd8aa5b7bf4af292960f215
- MD5 0c661f333713feab0826b2ff5a46988c
- SHA1 a63cd7f9b5e521db6bde712d8944fadc3644bb85
- SHA512 c5c1c9515e8c81ba4fd591965c9a9fd4aeededcbab83fc58161be6bdca6c1de7efd1d659aa74d88fa69d1e9f98ae373057ed65d843b8e5853a69ffeae86be2d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlh0Le5ji0hmxNrMPGkD:A3k03kB56rQRJHPji0Aj0
- TLSH T11585F716E6A407A5D06F8074CB965656FA333C410FA087DB02D4FA3D3F366D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe
- Size 1.8MB
- SHA256 d0915fc289ec607e2943c0e2b681d75222c111e88853294fd4ee25696fece0aa
- MD5 5812336147317f6df0c3135d11f025de
- SHA1 e1a889e55a1c4a72c534bba1691768c84c54aad9
- SHA512 dca2bfe2a2dc030d018b4eadd51eedef914435291b3e9390c2bb7c3791b7d58511029264823f8c098fc4c2da0b95cfc48bac787aa173e49d2a58a02c64b11288
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlh0Le5ji0hmxNrMPGk6Gen:A3k03kB56rQRJHPji0Aj+I
- TLSH T1AB850716E6A407A5D06F8074CB929656FA333C510FA097DB02D4FA3D3F326D19AB9723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 7a9a99b7870ef260ade816f78fe03bc5313e05664676b454b7d1eb336695c688
- MD5 38a331667176bc39dd889d8db2586ea9
- SHA1 cef7add5cb6a6686fad61de2d3b46aaa22fa2b2d
- SHA512 0461dd502d9fe59e1165fa883cc0a625eb6145e81bcf26dd85b45e92b3d3a1826e3c8a3ec3ffbfdedf6f921fd6efbba216b5724a564d9fdfdbe53f05e2d0def8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlh0Le5ji0hmxNrMPGk/0Le5ji0v:A3k03kB56rQRJHPji0AjsPji0Aj
- TLSH T159B50716E6A44765D06FC075CA929656FA333C410FB08ACB02D5EA3C3F376D19A7A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 1.7MB
- SHA256 b06657d33ef38c1d9ad7cc64c5e038007f8f7763676110f230190ad640fe355f
- MD5 e63c1749d071efdf1eec0efb4f7c4672
- SHA1 2d6cb4213e8b030c6f06afbbd92996747f248ea4
- SHA512 e3746fda241dcd2571afe6e8fb99a0a52adecb2fa885d8c06b25836121898ac7d3d04c5af5a63fa5cde92f2b4c0edb334b33e4d38136ff22805fc7c4203b2cf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlh0Le5ji0hmxNrMPGkg4:A3k03kB56rQRJHPji0Aj+
- TLSH T1AE85F716E6A40BA5D06F8074CB965656FA333C410FA087DB02D4FA3D3F366D19AB9723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.7MB
- SHA256 2ce57300f4c09270763d40a96ab159bce1ff661329e52273df3b4248f3dd380b
- MD5 9952231d4d0e8f8e8933f6d194913ec2
- SHA1 634cfe080f858e241458a9b6ff526d6a3966367a
- SHA512 4863475dbcacc480dbc2fb72204687bdfd5735fe955da0a21cccb8ce2cf83574fe48b3dd1b988ee06d874e34350e5a693d6fa9f5158ad2b119230d6471e73f99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlh0Le5ji0hmxNrMPGkbF:A3k03kB56rQRJHPji0AjE
- TLSH T1B685E616E69407A5D16F8074CA969656FA333D810FA087DB02D4FB3D3F326D09AB9723
- MD5 SHA1 SHA512 SSDEEP TLSH