Analysis
- max time kernel
90s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 11:52
Behavioral task
behavioral1
Sample
2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260813-n1ppjsae72
- SHA256 2a54e68c90e819d3629b4545a9d78e59e42cc34c79e42a7f10eabfb39786bada
- MD5 e8d7c10fdd5c73fbdb65d4bf75bb368a
- SHA1 d53e23fc3e5a565e6d67348ac319cd8c7b29c98f
- SHA512 539933f9fab6773b9bfc3ed82fe63a41c159dd7e8ada13b6acf752809e05c44369f0eb8a78b365ae44f99d8eed25c88fa63405ed5a894503918cd82d59bf6160
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKTl:A3k03kHRJOeW4SkZP4sz9MbE56rX
- TLSH T1EE953A16F6784B62D07BC0B9C5D6AA56FA323C465F3087CB03459B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/52-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b00000001c6e9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/52-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4512-82-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-287.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995a-527.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995b-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b00000001c709-2105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000000013b-2107.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000b00000001c6e9-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-287.dat aspack_v212_v242 behavioral2/files/0x000300000001995a-527.dat aspack_v212_v242 behavioral2/files/0x000300000001995b-525.dat aspack_v212_v242 behavioral2/files/0x000b00000001c709-2105.dat aspack_v212_v242 behavioral2/files/0x000a00000000013b-2107.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4512 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 52 2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4512 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e8d7c10fdd5c73fbdb65d4bf75bb368a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:52
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4512
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 2a54e68c90e819d3629b4545a9d78e59e42cc34c79e42a7f10eabfb39786bada
- MD5 e8d7c10fdd5c73fbdb65d4bf75bb368a
- SHA1 d53e23fc3e5a565e6d67348ac319cd8c7b29c98f
- SHA512 539933f9fab6773b9bfc3ed82fe63a41c159dd7e8ada13b6acf752809e05c44369f0eb8a78b365ae44f99d8eed25c88fa63405ed5a894503918cd82d59bf6160
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKTl:A3k03kHRJOeW4SkZP4sz9MbE56rX
- TLSH T1EE953A16F6784B62D07BC0B9C5D6AA56FA323C465F3087CB03459B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 4a5f13853c2322e399255a784cc923fb4e8698f8ae11edf8653f916c5a707e3d
- MD5 8c607d9d29ed040151a189e82c465506
- SHA1 a431eb2983eb0d2557b5e8a2ec4ceb1755c0764e
- SHA512 8dd0fe3cc2783dff7fdbc892c78d8499ec6441084ce7dc0351f916c8ac61ffa59390401bb5410d88f5c9988dca5080961433254828579062e67388e7e381cc9d
- SSDEEP 49152:A3k03kHRJOeW4SkZP4sz9MbE56rTPji0Aj:A3k03kHRwfkZcBrLjo
- TLSH T127C53916F6784762D077C0B9C5D6AA5AFA3238461F3087CB0345DB283F277D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.9MB
- SHA256 c4484b982b000edd6c07cb14a58ca5d8160bc63eea02ac5711a9a9fb5af6f986
- MD5 d3930d41f36e19fd268858ffb316d0a2
- SHA1 e6859ebdd5a9dd7ebf17310b792f92050bb6419c
- SHA512 bc8381f69e1e6fc9c77f604db8e47f6cdaaa8db61a413f63d5efa587738f859459df85d7efedf008b7c92c1ff26d5a7edfc0d85e2c9128eec62eb54e486a2ba9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKTO:A3k03kHRJOeW4SkZP4sz9MbE56rE
- TLSH T12A953A16F6784B62D07BC0B9C5D66A56FA323C465F3087CB03499B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 1.9MB
- SHA256 0e87bb24be042bb6d8d168af00e77b7b57767fd8e7647fff128820b1c7cce35d
- MD5 4cb4670d6a06ee403c06cf3a0a121432
- SHA1 bde0311bb149f19f76dced28d51c108da01d507c
- SHA512 904b4e48bdc12575ad533e9eeefbb3902173f8c6f73104cb0b359a35d37ab64f7b237e9cdc1d937a36783bdf828c1cdfebd35721a9e5e2e513841b2e96063036
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKTS:A3k03kHRJOeW4SkZP4sz9MbE56rA
- TLSH T1DF953A16F6784B62D07BC0B9C5D66A56FA323C465F3087CB03499B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 1.9MB
- SHA256 f1f20e06e44d48952f10808d3730c3ed7fb0f246f943dd84b9264a51041d8f73
- MD5 947058d43b08f2a72ae33ddb13fce890
- SHA1 db95c22a6671c0642ac9267b70b3186809c1d14b
- SHA512 41e190dc064c7f702b84c88ade51ca2b4651d01c666f398e6d38e1d5ed1fe3118fe7fbc3e56f464ec2de175daf89c7bb92d2f9e5d5166bb5c1c2db67eb8a719e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKTL:A3k03kHRJOeW4SkZP4sz9MbE56rp
- TLSH T172953A16F6784B62D07BC079C5D66A56FA323C465F3087CB03499B283F277D19A3932A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- Size 2.0MB
- SHA256 98712816aa9a24834d5e55c0f5f0bb906d03f41fd01276a3cf77f0bb516101c8
- MD5 669b0dfbb37ee6c9f2b507e047036730
- SHA1 9b3fdae7bde48659369b428da29c30e0d4c5f499
- SHA512 fc201fbd51fb066c25ae5e743c88513fc1f771cf6cae97566233bfe57b84d7d7048035dbc6a853b6db81eef8137c4ae6b3ea75fa06f934ceff9bd053dd724d48
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKT7:A3k03kHRJOeW4SkZP4sz9MbE56r9
- TLSH T161953A16F6784B62D07BC079C5D6AA56FA323C465F3087CB03459B283F277D19A3932A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 2.1MB
- SHA256 0b6e19894d28091b07b198f84ead5bcd93ca70a57b53a5c4f60e32db3aa7f5e4
- MD5 371a427b1553f6c7699e0eb5f92d3b26
- SHA1 f0ac64c8b34f467f3ea0949d953eaddfaf2a81fb
- SHA512 d76f0181676c3e94b63bdf9328c4b610ee98a5e062e1809aa4ddba6114a0b292ee0f14d4a1bab5eaf8c02f3cbe474f0d6a167c0d443e99a975ee2f265bbd0ad3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWs116Ze0p4Ek4niOkl/A04szE87JKTa:A3k03kHRJOeW4SkZP4sz9MbE56rLIiHq
- TLSH T17EA54A16F6B84B62D0BBC175C5E66A56FA323C461F3087CB03459B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH