General
- Target 2026-08-10_7b00ade2167b206df4a30d7c5d963797_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 4.8MB
- Sample260810-cvw1wstvay
- SHA256 c0ae2383310072e44a5dff653ff1957adb0d414117e86af368ac9a50ed20e227
- MD5 7b00ade2167b206df4a30d7c5d963797
- SHA1 1df6cac9ab714189be604764c4b9007cee0e7056
- SHA512 cc244800428941166392bf02734af8185a90b922ca6ebbb0399d62d432c1e94ad9cc5a73c89787c28591dd66ef2476b61e4f4ba52c304843f0cbf37a30da3da1
- SSDEEP 49152:wabH/HabH/1RJY/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRf:8R5WQtZ/K0tGOFWVRuLftCT5
- TLSH T1D9365C13F6E940E9E0AAD178DF3586219B327C698BF165DF324036D51E72AD07B38722
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-10_7b00ade2167b206df4a30d7c5d963797_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-10_7b00ade2167b206df4a30d7c5d963797_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target 2026-08-10_7b00ade2167b206df4a30d7c5d963797_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 4.8MB
- SHA256 c0ae2383310072e44a5dff653ff1957adb0d414117e86af368ac9a50ed20e227
- MD5 7b00ade2167b206df4a30d7c5d963797
- SHA1 1df6cac9ab714189be604764c4b9007cee0e7056
- SHA512 cc244800428941166392bf02734af8185a90b922ca6ebbb0399d62d432c1e94ad9cc5a73c89787c28591dd66ef2476b61e4f4ba52c304843f0cbf37a30da3da1
- SSDEEP 49152:wabH/HabH/1RJY/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRf:8R5WQtZ/K0tGOFWVRuLftCT5
- TLSH T1D9365C13F6E940E9E0AAD178DF3586219B327C698BF165DF324036D51E72AD07B38722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1