Analysis
- max time kernel
100s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:21
Behavioral task
behavioral1
Sample
2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260810-wznpvseq6z
- SHA256 826d51899a198ba9f105132860eef381051a4cace6898b577fb89cbca5883e0b
- MD5 ad6e7b0a955f3081435f5c59ba2de03a
- SHA1 ae6a54448f2aed53b4feb26ed6fe2bc297736d11
- SHA512 165be76902b5fd93ea9f6d66b94b2d6eaefa88c98ee8375b9f81e008c22ffe9ddd073ec29e32e34cedb5db92fa154b22155807d6947d13b44351474c13615192
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagEFYTqMi8CtBd2QHCHmTBW5w5jcG:A3k03kHRJARJ/qJtb2IRpYq
- TLSH T10E955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2836-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2836-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4124-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001761c-105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019988-564.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998d-562.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e4-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000700000001761c-105.dat aspack_v212_v242 behavioral2/files/0x0003000000019988-564.dat aspack_v212_v242 behavioral2/files/0x000300000001998d-562.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4124 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2836 2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4124 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ad6e7b0a955f3081435f5c59ba2de03a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2836
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 826d51899a198ba9f105132860eef381051a4cace6898b577fb89cbca5883e0b
- MD5 ad6e7b0a955f3081435f5c59ba2de03a
- SHA1 ae6a54448f2aed53b4feb26ed6fe2bc297736d11
- SHA512 165be76902b5fd93ea9f6d66b94b2d6eaefa88c98ee8375b9f81e008c22ffe9ddd073ec29e32e34cedb5db92fa154b22155807d6947d13b44351474c13615192
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagEFYTqMi8CtBd2QHCHmTBW5w5jcG:A3k03kHRJARJ/qJtb2IRpYq
- TLSH T10E955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 8de639e72228aff2c46696944f860c13d4bac75a916257b54b921b7943bb3937
- MD5 c473684d6c80958b5dabc466860acd4e
- SHA1 e83445ef45d22a5ff3025a7a497bbea5419cfa4b
- SHA512 11e790edc1bbacfce7735e4c05686a01454eecade6612cf8b4f7d4919dcd21798b6c3426475a2af04a559aa1ca90ca226bddc994045c68fc2c94a0b6a9c36250
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagEFYTqMi8CtBd2QHCHmTBW5w5jcI:A3k03kHRJARJ/qJtb2IRpYqjPji0Aj
- TLSH T1C0C54B16F6648375D073C0B9C5D2A69AEE3234425B308ACB1385D76C2F277E6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 1.9MB
- SHA256 1a371be22b2830d07ab9bd491fa957f66ec5ea299788366045257ef3ef87f13e
- MD5 05b75bfb6f184f109dcf0f6fbe88545b
- SHA1 a9d609d05e9b906f3a37a877e51b8c65f5c022bc
- SHA512 89cedf2a26da83513afdbf8378426e22421e964d4ff9336bea4d19e3a41ef9eaba2dca5f7718ccb47d8546946e96d54172ff5639827c7761cb9f85d0bc0defe3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagEFYTqMi8CtBd2QHCHmTBW5w5jcm:A3k03kHRJARJ/qJtb2IRpYqT
- TLSH T1BA955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$
- Size 1.9MB
- SHA256 675be0c0a598422399cccc9d699e6d4466af33510085ab9da86597019c3391e3
- MD5 dc71c105865dbab5f5cf76a332f748b8
- SHA1 1cea9fb42df84c291378caf21df4f56cbba4a2e3
- SHA512 2abb4da8298fb1c753b45236ad7a948be56c422148b12aebcbf45f88f2b5cca359167dfafa7471cbe0e82c762264e7f0f5c0da9480369886a70cc8efc97ec5ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagEFYTqMi8CtBd2QHCHmTBW5w5jcH:A3k03kHRJARJ/qJtb2IRpYqG
- TLSH T103955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
- Size 1.9MB
- SHA256 9ba95c2dd94052ee34c09d58847c8b01d76607967a694082ed1223840cf3bb10
- MD5 fa6221ed32280afafb655fdfb414e853
- SHA1 2cfe6e332022bf245f517903dc76731659418908
- SHA512 bd332ddc38a040ebfe2a1ea11c0e901ea386de707931d9296300183bbc29a3709f840367df44e8a43e0ad06071b80dba781a474862db66a018258491045b27a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagEFYTqMi8CtBd2QHCHmTBW5w5jcd:A3k03kHRJARJ/qJtb2IRpYqaD
- TLSH T1F0955C16F66842B5D073C0B9C5D2AA5AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH