f73115dc88d0025ca3da2dce48a54d2c717d9de8481386c156b3ac7d32bd060f

Analysis

max time kernel
97s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.4MB
Sample260810-xcmpqaaa56
SHA256 f73115dc88d0025ca3da2dce48a54d2c717d9de8481386c156b3ac7d32bd060f
MD5 5afe0d222eae3d66bafaf5f5036ca788
SHA1 bf7d3487b6b025bfb4dade8c6c31a2cd45f07a5f
SHA512 0abeb9223c1c3b099ef01434b157cbda0f9d82120980c28f08543dc29c248b5f03d5ae0ada0203accd9b4dd316ac23cbc44f62134fe84ac8508065981c250588
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyE:A3k03kHRJppYq
TLSH
T1FE657C17F7A441B5D067C1B9CAD2AA66FE713846173097CF1398C7282F23BD19A3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/6792-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c63b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6792-165-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6844-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-461.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b000000019cb4-1025.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019c87-1284.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c63b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-461.dat	aspack_v212_v242
behavioral2/files/0x000b000000019cb4-1025.dat	aspack_v212_v242
behavioral2/files/0x0004000000019c87-1284.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6844	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6792	2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
6844	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5afe0d222eae3d66bafaf5f5036ca788_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6792

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.4MB
SHA256 f73115dc88d0025ca3da2dce48a54d2c717d9de8481386c156b3ac7d32bd060f
MD5 5afe0d222eae3d66bafaf5f5036ca788
SHA1 bf7d3487b6b025bfb4dade8c6c31a2cd45f07a5f
SHA512 0abeb9223c1c3b099ef01434b157cbda0f9d82120980c28f08543dc29c248b5f03d5ae0ada0203accd9b4dd316ac23cbc44f62134fe84ac8508065981c250588
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyE:A3k03kHRJppYq
TLSH
T1FE657C17F7A441B5D067C1B9CAD2AA66FE713846173097CF1398C7282F23BD19A3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.9MB
SHA256 08bce287ea69dec753477463f6e0ef78243c2ce9913d18921ecaa7ad83d5bffa
MD5 e079d845585333ea27e9d283657739f1
SHA1 f8fd587ed3c806bbb53996aa264c69c76cdd4788
SHA512 60765123a5bbcf51abe5b23369a03ee9c2c6ff6acf793f25aae233c73eb0bc20b6b91b00c10267366401f115eab86b60921fb950600471f565eccb9e2d64214a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyED0Le5ji0hmxe:A3k03kHRJppYqjPji0Aj
TLSH
T164956C16F67442B5D073C0B9C5D2A69AFE71348217308ACB1399C7282F67BE1DA3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 1.4MB
SHA256 b4ad97448ed36779346fbdf6de9dad99afb60e9f1f268d2c3b47fc5e99b4c9d2
MD5 ab836d6fae8a355b0b5261af1139b6e0
SHA1 39ffec825c86efa5875f510dec45e985bd00bdda
SHA512 0995f60651b1246c3d75d35de8beec67e129cbaba331afd36cd3c4bede17fb2eed8421d78c2e0da80f1c2054c6f71fdcc9c741e26cd680af88555a2fb989c1fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyELk:A3k03kHRJppYqI
TLSH
T136657C17F7A441B5D067C1B9CAD2AA66FE713846173097CF1398C7282F23BD19A3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe$
Size 1.4MB
SHA256 70b3904c1126764711a78af9d5475253a1e18feae0148ae1717d1b2c00752de3
MD5 796800124b8546b22149c6cee12c1bca
SHA1 3b14fa0bc393c6f977abee4748726ed1ba0a0394
SHA512 39f8d255ead9465cbaeb8c58134509e04a5c3d120997f3d46553b6b743bf841efd3612378029d4fa20078a92606ee66b2039f42cfc821b6ddabe2f1c56790a45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyEuK:A3k03kHRJppYqh
TLSH
T14F657C17F7A441B5D067C1B9CAD2AA66FE713846173097CF1398C7282F23BD19A3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 1.4MB
SHA256 378e354f191256007913bcf33c41864ac342e60f545843876ee0f17a8118b340
MD5 5108a2594084bbb9fcbc0f6465ea17ad
SHA1 ba3c4cdbe55c71057027dde561a7cfbb7442616d
SHA512 c5a184305400dbc00a9dbf57e0baaba891eb5f556d53ce84002c6dfbf583d4fb7858c0d1f11a5f4f57310abe8ea26e250828a5e0782aaf64297c8d9768442141
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyE0M:A3k03kHRJppYq5
TLSH
T140657C17F7A441B5D067C1B9CAD2AA66FE713846173097CF1398C7282F23BD19A3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE$

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
Size 1.4MB
SHA256 0122f16e9050b7fa293800d67cc8637c90dbac5e5c6603ad79920517df6c907f
MD5 c37ae7bde84bbb7a06e9cdf6218dd4cd
SHA1 775dec6ffffe00b8da9d57f83229216ffa8b3e4b
SHA512 d68716bd0a519f5fc3f919a0715d939527c6b929937a5d381c53971227f1d4507ea9d99c4cc7ffc13467696b4a3da78a40ccc7a31549d4dac84c2f371b7657f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyEuwE:A3k03kHRJppYqk
TLSH
T114658C17F7A441B5D067C1B8CAD2AA66FE713846173097CF1398D7282F23BD19A3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 1.4MB
SHA256 88d0b6d6e1430db7db3748d07bcc37eb2b54d8af35e22b85577c398f8674a7a9
MD5 413b11ffd66cd359e1d587dca07d4c3b
SHA1 bbfc497c816984ec23f3be81b15772a6da4879fa
SHA512 4102c85030c1a32c2606bcc08e89be6d39711d59aff0e5fb914b36c0f5f6edf52ec9f034f9b00ae55bf51771884728f61d33d49e41bb7c568bde983f07c982bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapbc5Oa45jcAkSYqyEPF:A3k03kHRJppYqt
TLSH
T169657C13F6A441B5D067C074CAD69A56FA317C820B309ADF1398F7292F337D1AA3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6792-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6792-165-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6844-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads