Analysis
- max time kernel
88s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 00:04
Behavioral task
behavioral1
Sample
2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260816-acxtcswbrd
- SHA256 cd0d2e524f0152083d26b5a3db1f61e974a1db0bdb7dd83fd7b0fc20c2d0edcf
- MD5 b34ca01391350c52c7d680b48260e426
- SHA1 8e040c58c5fcd248ca454c5bddc44733cdcb5703
- SHA512 e3f38e60ff7c3bc0a4c4b0230feb19a8f2d520b9757fffb8a7611a592cc0ddb62f5e844c05b0f11c709b4993f1129b9b2e06fbeef545832740c8b561b2cec107
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3cOLSD5TvinrmbMD5TvinrmC:A3k03kHRJARJP056rX56rX
- TLSH T16C655A07A6980FE8D15F81748A928962E7737C125F2097CF1354AE263F72BD0AE39357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4200-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002459f-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4052-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4200-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4052-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245a4-143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216fa-1254.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002310a-1752.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002459f-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00070000000245a4-143.dat aspack_v212_v242 behavioral1/files/0x00020000000216fa-1254.dat aspack_v212_v242 behavioral1/files/0x000200000002310a-1752.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4052 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4200 2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_b34ca01391350c52c7d680b48260e426_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4200
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 cd0d2e524f0152083d26b5a3db1f61e974a1db0bdb7dd83fd7b0fc20c2d0edcf
- MD5 b34ca01391350c52c7d680b48260e426
- SHA1 8e040c58c5fcd248ca454c5bddc44733cdcb5703
- SHA512 e3f38e60ff7c3bc0a4c4b0230feb19a8f2d520b9757fffb8a7611a592cc0ddb62f5e844c05b0f11c709b4993f1129b9b2e06fbeef545832740c8b561b2cec107
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3cOLSD5TvinrmbMD5TvinrmC:A3k03kHRJARJP056rX56rX
- TLSH T16C655A07A6980FE8D15F81748A928962E7737C125F2097CF1354AE263F72BD0AE39357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.5MB
- SHA256 fd4c41778f596854a35cbcde9f9c43caccce9e388b89d4a1c93504d53614c0f3
- MD5 6ac4fdc8b69bde7b4d7b1e85cb4a1c79
- SHA1 e0aad3a393dc9f1ac314ab28eff4cf004367cb30
- SHA512 c4ddfce296d9b59ceab4588ccc9a7ba1654bc614f3e5a8cad728eb7733f59a85d6ceaa30e9f29fddb1022686613b9634262aeaef84b05a9f537b572f0d3f5f51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3cOLSD5TvinrmbMD5Tvinrm+TjE:A3k03kHRJARJP056rX56rNw
- TLSH T18C755A07A6980FE8D15F81748A928A62E7737C124F2097DF1354AE263F727D0AE39753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 121b4a148a6386759fb2fe82e2e2efb36b89281cea39e5a577e392652a464735
- MD5 e1b7b5503d5dc95e8a3756ace70634d6
- SHA1 e3c88cd12fd847a60822673442f50ba56f7aba81
- SHA512 a664c3f0dea5f33b78cd3c12ac6e3c4357bb9b385f4e8086560c934e8d62d8c395dc57bc07d7cc23b72c5e19a8870eb9a1211b54fd12f5c576d82b6eaefad7b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3cOLSD5TvinrmbMD5TvinrmC0Le5jn:A3k03kHRJARJP056rX56rTPji0Aj
- TLSH T191954916B6A84FA5D06FC178C5929656EA733C424F3087CB0354AE293F777D19A3A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.5MB
- SHA256 c3cce0f381ee639181fa18a4de37804508ece6863217075a4dbc11a02908e5a8
- MD5 2aa5ebf59801888a0b86c7653cf3e026
- SHA1 538eeed2c53ec2ffd5ddf02df26728cc278c0715
- SHA512 23de266fc2745197c9b5d7df69449522ae761791c2dff7313afe830f7687580168a7292871902e41864d53e3e0dcf3961bb3ca93b1073ed4a7a49e3653ff1f82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3cOLSD5TvinrmbMD5TvinrmrD:A3k03kHRJARJP056rX56rU
- TLSH T11C75F406E6980FA8D15F8174C7924562F6737C124FA097CB13D0EE3E3F72690AAB9653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 eb816b667d4715b54ecb305fb64656efaf1bd61b7b463fc16d90de51bea52562
- MD5 dc5283240fd6af290a767b9a1f10d1f8
- SHA1 ac297e61fcb1e8d6c848ab6d977aa32e8f9bf1e7
- SHA512 fc460e0f5a7079337de155f07fd92e85f6bc39c25cd7404fcd6d4e544943f2abc3d7a8c3b726120708cdba51fea4c1eb3684dde1ee09a4643965acd6864fdffb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3cOLSD5TvinrmbMD5TvinrmgF:A3k03kHRJARJP056rX56r9
- TLSH T149655902A6980FA4D25F8134C9968A62E7777C524F2097DF1354BE2A3F327D0AE39753
- MD5 SHA1 SHA512 SSDEEP TLSH