Analysis
- max time kernel
103s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 12:23
Behavioral task
behavioral1
Sample
2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260815-pkg57sw1cx
- SHA256 98b0b69771b2433d1139054ff103b770aa982be2f31c784918a59c3aee1706f1
- MD5 5d69b2d5745dea944938549f2b11aa24
- SHA1 457185963a8945b9138ce1664dc36bdb22cec3d8
- SHA512 09a1c3422180cb4ef5bbe0f0bc6643a45882e95d72ead7625ba38662185fb5edf0dc4e8b2f560007147f8ffc4ff48ec7c423afc9542682ede5017b38904f2abf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccnqRajYTqMi8CtBd2QHCHmTBW56w80Lu:A3k03kHRJ+qJtb2IRPji0Aj
- TLSH T130A55B16F6A44375D073C0B9C5D2AA9AFE3134825B308ACB1385D7282F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4060-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c54e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4060-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1148-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998d-573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019982-574.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c54e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-398.dat aspack_v212_v242 behavioral2/files/0x000300000001998d-573.dat aspack_v212_v242 behavioral2/files/0x0003000000019982-574.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1148 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4060 2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1148 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_5d69b2d5745dea944938549f2b11aa24_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4060
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 98b0b69771b2433d1139054ff103b770aa982be2f31c784918a59c3aee1706f1
- MD5 5d69b2d5745dea944938549f2b11aa24
- SHA1 457185963a8945b9138ce1664dc36bdb22cec3d8
- SHA512 09a1c3422180cb4ef5bbe0f0bc6643a45882e95d72ead7625ba38662185fb5edf0dc4e8b2f560007147f8ffc4ff48ec7c423afc9542682ede5017b38904f2abf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccnqRajYTqMi8CtBd2QHCHmTBW56w80Lu:A3k03kHRJ+qJtb2IRPji0Aj
- TLSH T130A55B16F6A44375D073C0B9C5D2AA9AFE3134825B308ACB1385D7282F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 cdf0f1b5d6c4b4130606534ede2d34c5e9a7fe5262407be51d5c897cae8cc8f8
- MD5 14c18cfd376f78d1408e6d7350e89971
- SHA1 3651e733fbe547a75ea2fab0cde07b6c26933550
- SHA512 9dfcc1c231f6d932ea3cc7e5a3a68a8dca813dacfbaf32dd5b1a1d03370e63766d6b104504b84e9053601504d4f510e72428f22fa907db924efcb5f0d6036119
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccnqRajYTqMi8CtBd2QHCHmTBW56w80Lc:A3k03kHRJ+qJtb2IRPji0AjKPji0Aj
- TLSH T1B9C54B16F6744375D073C0B9C5D2A69AEE3134821B308ACB1385D76C2F67BE69A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 2.0MB
- SHA256 cd26761007b677b215c842a098f7b150b62117fba2574c5efbb159eca42a3fa8
- MD5 019778b933d6b7cd447b0924f02a4742
- SHA1 03950bb736a13e0f5d50d3194e2c48b49e9edb8f
- SHA512 9e6b27d23ccd0feb4b632e3c7b44255099db10e67067cc44289b904e8321254b8319044218a3c236c727ac8208965426e355e634b0bc5cab1868f17c6c5b8854
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccnqRajYTqMi8CtBd2QHCHmTBW56w80LL:A3k03kHRJ+qJtb2IRPji0Ajd
- TLSH T16BA55B16F6A44375D073C0B9C5D2AA9AFE3134825B308ACB1349D7282F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 2.0MB
- SHA256 bde9158fcdcdd9548548acca756ff3768f01572da9f0e7962074bba7df3fe456
- MD5 dc7390ed23988a97113291293cce2bcf
- SHA1 dc98a34b6e28f410c8b41fff914d4e85b8f58cda
- SHA512 a40cdd6864907562ecdbadd02a623a2d311919fb1588dcf94a3ac830c8b1c1bfdf774245ae56ae081d37609e88aae2f82312a271abfc97ed6461d03857017fc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccnqRajYTqMi8CtBd2QHCHmTBW56w80LS:A3k03kHRJ+qJtb2IRPji0Aj0
- TLSH T1ABA55B16F6A44375D073C0B9C5D2AA9AFE3134825B308ACB1349D7282F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$
- Size 2.0MB
- SHA256 dbbe8e414783ddb04f88d6fde637144744d5438e5789c7e3171e182b930c0f87
- MD5 baa8ac08c1ceff9991626ef19610f063
- SHA1 86f64a7231e80867007ed67822cc311a8433e41f
- SHA512 cdd26bbd7708253a4b69c28bb39499a951c2c2abe2521df21d14811364eda94acbdef791cfa120c6ced60292f291df11c7f34c3ff36ea6308515eb2e884d4d87
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccnqRajYTqMi8CtBd2QHCHmTBW56w80Li:A3k03kHRJ+qJtb2IRPji0Ajs
- TLSH T1D4A55B16F6A44375D073C0B9C5D2AA9AFE3134825B308ACB1349D7282F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH