Analysis
- max time kernel
95s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 02:54
Behavioral task
behavioral1
Sample
2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 957KB
- Sample260816-ddvbeaybrc
- SHA256 1365ebdaba4f9526225d6cfb44d0651c0bd1705d2c7eceff947dabd77ad37e1e
- MD5 4732bef52e4e331078220d581ad230dd
- SHA1 8effd211e6c761ebeaac9b3ede381238b7f6c21e
- SHA512 e958ea985b670ab707b0b4fec67fcdd6d3a07064d7dd1f0872e742b2382a8ecfe6e33b9cfd95064010853f9c96a90752ed196236961929c08ece18606f700cfd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5AiT3C:A3k03kHRJXS
- TLSH T1AC25AE13EB9500E9D10AC174AAE58623EB75BD56277093DF2358C2152F62BC07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/3520-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5b2-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3520-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6048-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a725-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001894b-1480.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5b2-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-39.dat aspack_v212_v242 behavioral2/files/0x000400000001a725-1089.dat aspack_v212_v242 behavioral2/files/0x000600000001894b-1480.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6048 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe - Drops file in Windows directory 47 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3520 2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 6048 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4732bef52e4e331078220d581ad230dd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3520
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 957KB
- SHA256 1365ebdaba4f9526225d6cfb44d0651c0bd1705d2c7eceff947dabd77ad37e1e
- MD5 4732bef52e4e331078220d581ad230dd
- SHA1 8effd211e6c761ebeaac9b3ede381238b7f6c21e
- SHA512 e958ea985b670ab707b0b4fec67fcdd6d3a07064d7dd1f0872e742b2382a8ecfe6e33b9cfd95064010853f9c96a90752ed196236961929c08ece18606f700cfd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5AiT3C:A3k03kHRJXS
- TLSH T1AC25AE13EB9500E9D10AC174AAE58623EB75BD56277093DF2358C2152F62BC07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.0MB
- SHA256 c56af16d2679f5e9badc6cba8b97941b8660fc67e5f284ba4c5d982b81d8d131
- MD5 d7da5e6d763578e28e6b09c796efcb24
- SHA1 38e55ffbb9d8d2f98e4b07938b02bb14b7b93650
- SHA512 a5caa60b55fddbe10ad776ff20f10b2b7f89166b9190adc3424cfc1c7058146bbd5d0e61aef73fec5e49e953d35740c2268b000d948223efbeba1b5d5d8c288e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5AiT3Ghk:A3k03kHRJXWW
- TLSH T1BC35AF13E79500E9E11AC2749AE58A22EB75BC561770D3DF2358C2152F63BC06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 7848df8781c5c89f2c6665a22f6a23690dbbe8374ba3e5cef6851d1211fe3325
- MD5 0973eb6697bf33887d7f2f8311fca26b
- SHA1 ee3a3f418befe2d222f4ed59d8ed3ce97d9604d1
- SHA512 9fc789efdd48ff272030d740c775859cf9f2b08d24908c4bf872c059ec767cc2c5aae9b52d881230cc4b75240497c43fac0c7c2d371e5dbe5f65c55077bd6f79
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5AiT3C0Le5ji0hmxNrM:A3k03kHRJXSPji0Aj
- TLSH T198658C17F6A402B5D027C1B9C5E6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 972KB
- SHA256 9580cceb98f0f97980ea45c6081d4ef43a815afbf6baf74b63206e5822cfc221
- MD5 644439099945da889f718da394aa40eb
- SHA1 1b32407ff60ce195b130251e37b34aab24b9bc1f
- SHA512 848afb88412cf55c8d146428f19e1ebd509266547744c02f391ebd5c96116c5e774950de074c2bb2f8d19fb7793a335a61040b16d5cd43e4c638cdce6c790820
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5AiT3Ma:A3k03kHRJX
- TLSH T19425AE13EB9500E9D10AC174AAE58623EB75BD561770D3DF2358C6152F62BC0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
- Size 1005KB
- SHA256 ff3e1b193670b65e79c460800f6949365f0b2ea990c1318ed4a25942526c7cba
- MD5 54292cfd0889944c2169f1794dd13f3c
- SHA1 03474dae7e7533461092d7c2d3aefcf4e93fecc5
- SHA512 fa5f87b5fe304adef4cd16dcfea5573f53cbbd3c92dea450d14ad85a9ca8eb6dffc41b3c6802355e1293ef2fac11a7e95890310e43c8054cd1900536e35d31aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5AiT3lY:A3k03kHRJXVY
- TLSH T1D725AF03E79404E9D10AC574AAE58A23EB75BD562770D3DF2358C2152F62BC06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH