Analysis
- max time kernel
91s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 04:40
Behavioral task
behavioral1
Sample
2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.0MB
- Sample260811-fa2bna1ybs
- SHA256 71e5f60b714ef2f85835f8ed98f1b80917d04210a1124d543d8d35aa3494982d
- MD5 fcf1a5c58e0b70dc2277839694bc5adc
- SHA1 a084d361f9b7606bade3ce51807e2fb4b9fdbb3a
- SHA512 6134a9958cae332da3ee6e00f772fe21da38a28c2b326c44fe226d19ddd4fe79f8a81b8904390c8d0456e55fb85df5336c32682ede1f30708a59bf0f7ff9e321
- SSDEEP 49152:A3k03kHRJ8qJtb2I4turNp5B56r+qJtb2IziepYq:A3k03kHRG76dCr+Eie6
- TLSH T168164A52E7644EB5F02AC074C4E2566AEA723D450BF296CB024EBB292F337C55DF9321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/6860-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5c5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6860-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2824-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b0000000198db-562.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0020000000018894-1523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001c0000000064b6-2112.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5c5-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x001b0000000198db-562.dat aspack_v212_v242 behavioral2/files/0x0020000000018894-1523.dat aspack_v212_v242 behavioral2/files/0x001c0000000064b6-2112.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2824 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6860 2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2824 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_fcf1a5c58e0b70dc2277839694bc5adc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6860
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 71e5f60b714ef2f85835f8ed98f1b80917d04210a1124d543d8d35aa3494982d
- MD5 fcf1a5c58e0b70dc2277839694bc5adc
- SHA1 a084d361f9b7606bade3ce51807e2fb4b9fdbb3a
- SHA512 6134a9958cae332da3ee6e00f772fe21da38a28c2b326c44fe226d19ddd4fe79f8a81b8904390c8d0456e55fb85df5336c32682ede1f30708a59bf0f7ff9e321
- SSDEEP 49152:A3k03kHRJ8qJtb2I4turNp5B56r+qJtb2IziepYq:A3k03kHRG76dCr+Eie6
- TLSH T168164A52E7644EB5F02AC074C4E2566AEA723D450BF296CB024EBB292F337C55DF9321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 4.5MB
- SHA256 535b5b562de782b469c9931fa6ab073b36aac23e8acc1b08d7e40514867e16a3
- MD5 346305b4a7837072d75a72ae211eb82d
- SHA1 562fc85e860022557a8434fd877ab557edc6ccfe
- SHA512 dba87d555ca1762b3aa168a344531451d5dcacb6e960f84b170d5335473b89d60ece2664cf6029fc8e263d6a615f9f86536d46f3cd10ba86dc139d0ae7bbff32
- SSDEEP 49152:A3k03kHRJ8qJtb2I4turNp5B56r+qJtb2IziepYqHTd9CHKyao:A3k03kHRG76dCr+Eie6YCqo
- TLSH T11C264A52F7644EB5F06BC074C4A2566AEA723C490BF186CB024DAB292F337C59DF9721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.5MB
- SHA256 e427d918364fda959d7e5d8018318031e22c184b5078ca263a2546fac5566088
- MD5 90e5d8a6a37d4c6f0b688238ec3af10c
- SHA1 7a8386db5992ae8e217f19daa68b49dcedfd55fa
- SHA512 ba9502a070543121355229f61495f8471fc96d1e08d26a7349ac3e49ec678ccad233187ccf7ce86b92705814f1fd49cc1b46b3b13456700907d45854ca8a979e
- SSDEEP 49152:A3k03kHRJ8qJtb2I4turNp5B56r+qJtb2IziepYqjPji0Aj:A3k03kHRG76dCr+Eie6Gjo
- TLSH T160264B52F7648FB1F02BC074C5E2566AE9723D450BB186CB024EAB292F377D589F9321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$
- Size 4.0MB
- SHA256 4b4b933af70b1063b790dad45940ac96f4a5998b3126991287949c1e16fb1673
- MD5 bbf81f535cde1ec3f51780ce478336ac
- SHA1 7f2169838a0e538988e9d9414aba9465fec1a39e
- SHA512 115d1f7915e5407ba0cd8b0e54483e6b2c7afe43968329a19a8071982a5b641a08813350c972f9e3e858123942c9d3c82fc424c58c78c730df25b2a8786f9028
- SSDEEP 49152:A3k03kHRJ8qJtb2I4turNp5B56r+qJtb2IziepYqE:A3k03kHRG76dCr+Eie6p
- TLSH T113164A52E7644EB5F02AC074C4E2566AEA723D450BF296CB024EBB292F337C55DF9321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 4.0MB
- SHA256 545e4f76afdb59e442ac340d7939491bc915fac0fffbf053c753d338ed2ee85a
- MD5 ec0d9894b531b343b9855191f053d256
- SHA1 87148c093466a3c5d671279137d477cb7b0fc215
- SHA512 f1c0505ae858e2d2853fc2ee57baa9ae596d94b08d10c1c87212260a7514e5678d7e332c0f0399c7f9a186fd90e8a3991a320326c4b7280121d112dedb7645ab
- SSDEEP 49152:A3k03kHRJ8qJtb2I4turNp5B56r+qJtb2IziepYq:A3k03kHRG76dCr+Eie6
- TLSH T1B8164A52E7644EB5F02AC074C4E2566AEA723D450BF296CB024EBB292F337C55DF9321
- MD5 SHA1 SHA512 SSDEEP TLSH