Overview

overview

10

Static

static

10

2026-08-15...ry.exe

windows10-2004-x64

9

2026-08-15...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    107s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 10:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_811677fe9fa85559113b24a1c5e275ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
  • Size 4.9MB
  • Sample260815-m2rd4avyfs
  • SHA256 3d239768b34c0a86e062a32f2627e5d85a6cec998cc6acafd4992bcf8f3f3b91
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
aspackv2discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with ASPack 14 IoCs
  • ASPack v2.12-2.42 10 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_811677fe9fa85559113b24a1c5e275ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_811677fe9fa85559113b24a1c5e275ff_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4544
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 4.9MB
        • SHA256 3d239768b34c0a86e062a32f2627e5d85a6cec998cc6acafd4992bcf8f3f3b91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
        • Size 5.0MB
        • SHA256 7d7af4a8396cd056ad9c7cea2331e5a94da9bf1ecc129271df060a67f0e5ca1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe
        • Size 5.4MB
        • SHA256 1e5dbcfb3bc4841af3f52ba88594fa96d998059ee2c0a921cec79ec82a8e3b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 5.4MB
        • SHA256 e17a935861d14ce82f8444641c88bd61bbe9cc6ffb56e0f328d0d4d60f3e435d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 5.4MB
        • SHA256 4a24d717127f071ae66841d32ddd32c1898e114ad8d76da6015e521cce14ed50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DW20.EXE$
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
        • Size 5.5MB
        • SHA256 783713134b630f7349c5be3745246b5da880dca8d22286e3ed2b3aa41810b769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msouc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
        • Size 5.0MB
        • SHA256 6d80ed86923ff0c0f85c8aef5ff8782a990171bdd87f6776d2a56e49091943fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msouc.exe$
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$
        • Size 5.7MB
        • SHA256 a463424d2c7de4d8346a5074e4a3a20a53134a016a063798b516f25f8a386775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pptico.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
        • Size 5.4MB
        • SHA256 296deab6abfab9f308ce5bfb241eaa89cd80d02101e2fdab278a9a12b9f9bfc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdge.exe$
        • Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
        • Size 5.1MB
        • SHA256 50798ff1e74b266a56688a676c9d0f851280660344b87adff3cd396baccced7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3916-17-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/3916-7-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4544-0-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4544-16-0x0000000000400000-0x000000000040F000-memory.dmp
        Download