General
- Target 2026-08-10_1a936b5b4f412f553af0df5d0194bd3a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 748KB
- Sample260810-dgb91azend
- SHA256 a314ab40b4a833c7994b0e9e9fdb887270620f86d8ae5191785e3d5a1b716433
- MD5 1a936b5b4f412f553af0df5d0194bd3a
- SHA1 7fc1ecf5d788c0a844325dba68fc7a29cb6f8395
- SHA512 d490bd036ba43efe3e8671aece3ef62f7be45d4eafabec128f9d6b2e1f8a9b643542fcb64baec8f0dc6624d7c782c20fcb53037682133fe40a77ac59bb60b4e4
- SSDEEP 12288:w4Ryed8I7r/7m4UG4Ryed8I7r/7mKv0sf+WcRGJlFEaUWii9LBfsHPAhrPrDME:w4R5CIH/7D4R5CIH/7Hv0MXcMJloQLRN
- TLSH T183F46C23F74450EAF056C1B86A658616FA317D710760A9DF73807B1A2E32BD3BA7431B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-10_1a936b5b4f412f553af0df5d0194bd3a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-10_1a936b5b4f412f553af0df5d0194bd3a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-10_1a936b5b4f412f553af0df5d0194bd3a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 748KB
- SHA256 a314ab40b4a833c7994b0e9e9fdb887270620f86d8ae5191785e3d5a1b716433
- MD5 1a936b5b4f412f553af0df5d0194bd3a
- SHA1 7fc1ecf5d788c0a844325dba68fc7a29cb6f8395
- SHA512 d490bd036ba43efe3e8671aece3ef62f7be45d4eafabec128f9d6b2e1f8a9b643542fcb64baec8f0dc6624d7c782c20fcb53037682133fe40a77ac59bb60b4e4
- SSDEEP 12288:w4Ryed8I7r/7m4UG4Ryed8I7r/7mKv0sf+WcRGJlFEaUWii9LBfsHPAhrPrDME:w4R5CIH/7D4R5CIH/7Hv0MXcMJloQLRN
- TLSH T183F46C23F74450EAF056C1B86A658616FA317D710760A9DF73807B1A2E32BD3BA7431B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1