Analysis
- max time kernel
117s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 01:57
Behavioral task
behavioral1
Sample
2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 2.9MB
- Sample260813-cdeqaazcjb
- SHA256 724673081876955e77b415c8f6a6485e49e3ab50a32204225e193a97ba02c69b
- MD5 06167e6359627639512ca61c3a85e5f4
- SHA1 a8c76bc6fc263418bf059270b63018d43aa0eba3
- SHA512 ca09449a4c358f3fa7a1fff3873b8224c549496b87926f98ce2d9972b4cbe76001ceaba265e29d2a40d5fd3fbcc808478f76ae1f4c37aa6c96fe0cda830558a8
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9Mb:A3k03kHRdf87Iws1lkNufkZc
- TLSH T139E53B16F6B84372E0B3C175C9E2AA5AFA3238515B3086CF0345936D1E27BD1DA36736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4528-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c431-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4528-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3264-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-441.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac27-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001a52d-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d0d-1258.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c431-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-441.dat aspack_v212_v242 behavioral2/files/0x000300000001ac27-1007.dat aspack_v212_v242 behavioral2/files/0x000700000001a52d-1008.dat aspack_v212_v242 behavioral2/files/0x0003000000019d0d-1258.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3264 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E03D5D6C-388E-4B12-B85B-347D19A529BC}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4528 2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe 3264 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_06167e6359627639512ca61c3a85e5f4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4528
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 724673081876955e77b415c8f6a6485e49e3ab50a32204225e193a97ba02c69b
- MD5 06167e6359627639512ca61c3a85e5f4
- SHA1 a8c76bc6fc263418bf059270b63018d43aa0eba3
- SHA512 ca09449a4c358f3fa7a1fff3873b8224c549496b87926f98ce2d9972b4cbe76001ceaba265e29d2a40d5fd3fbcc808478f76ae1f4c37aa6c96fe0cda830558a8
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9Mb:A3k03kHRdf87Iws1lkNufkZc
- TLSH T139E53B16F6B84372E0B3C175C9E2AA5AFA3238515B3086CF0345936D1E27BD1DA36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 1c6bd35b4c94f8746d88e4549b331986b45cc14f1bf4d242b15b65ba07a60632
- MD5 37a2284494829f13604bb7e6d2910973
- SHA1 89a47d87cb5994460982fb43c7e2120a2a614540
- SHA512 7a71785be4dcf33f10462b44c8d0d544334960ee1f1041575b4a383958c8598976276260873e636701051b223b572c5a251e9c45b05633222f8acc9da640e4eb
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9MbBPji0Aj:A3k03kHRdf87Iws1lkNufkZcRjo
- TLSH T184F53B16F6B84376E0B3C179C9E2A65AFA7234415B3086CF0345976C2E27BD5CA36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 2.9MB
- SHA256 2f5cea1ab3a791ac8698d0da3b7a26f46ab7786551599eef20d7049c96e35d92
- MD5 1c7aa6815a02ad096277829c00db6b38
- SHA1 6fc3835c6469bf1e7fd28875f03da9db83be7a84
- SHA512 f40cc2fbf78896b9cdb3a85c581d5d01fc9c9536efc952d9093980f025c521611f8feda43fc1771f24bde15d8830fe780824c2af857461a31725b594481fa6b5
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9Mb4:A3k03kHRdf87Iws1lkNufkZc4
- TLSH T11AE53B16F6B84372E0B3C175C9E2AA5AFA3238515B3086CF0345936D1E27BD1DA36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 2.9MB
- SHA256 c7fe09254e0676418c545440aff7534e1994bb781db9080d3120137f711f474d
- MD5 ba0e1aebb7a99e80a8473a9c58712342
- SHA1 060f632e9e5a7a4b68c6272792b4e4371591c8e6
- SHA512 bbb92884f2de086ed6cd04d3f7dc4ae1a6e60449418b6bacf218a522249c2fef82dac9194602017f5aeea73e3bffd063fc4548ecbff4092834a7e85e4b70a399
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9Mbu:A3k03kHRdf87Iws1lkNufkZcu
- TLSH T1BAE54B16F6B84372E0B3C175C9E2AA5AFA3238525B3086CF0345936D1E27BD1DA35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$
- Size 3.4MB
- SHA256 efa21a99c15a4a99655ff5087651ceabc4b404525dc246e9a0b97efbaed0309c
- MD5 76c4c4e3bd42b896cf3afa7912c114a7
- SHA1 e00fe80f0c3d1aac79efef2d10177ded90b01829
- SHA512 5bac47e99ea83a7e4381b0cdef47d9b7956a25fec7aaf64915d4f5a2b05ecd83e8e7cee85523ef980eaeb175dc4ffbf04793145e33a4db0570570c417db6c3d9
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9MbL8tDZqrKV:A3k03kHRdf87Iws1lkNufkZcLm
- TLSH T18BF54B16F7B84372E0B3D175C9E6A666FA7238411B3086CF0245D36D1F27AD19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.0MB
- SHA256 40ce5f81f30862d72b6ea1117ba59c9e2924b56d75b9cbce4fd3a49533b5eff2
- MD5 5009fd62359b89aba9b58844144f40f4
- SHA1 635041e7790e8c3327dc33a59cd4c229bf14fa73
- SHA512 24ea1fe7957860268a8d51075f83e1c94b557aa9bf0b59e0e0c24abf313aed7e32e3d71bc86d224f557f87a0fbce80339ed287a557de43aede8b5e09c3c65cf1
- SSDEEP 49152:A3k03kHRJzfqJtb2IMC17Iws1lkWu0y2eW4SkZP4sz9Mbj:A3k03kHRdf87Iws1lkNufkZcj
- TLSH T11BE53B16F6B84362E0B3C175C9E6AA5AFA323C511B3086CF0345A72D1E37BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH