Analysis
- max time kernel
127s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 19:57
Behavioral task
behavioral1
Sample
2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 1.8MB
- Sample260816-ypbcwswdqa
- SHA256 a164c4bcacb6b24349e240cfef6d82f1bfc88feea812ce077aed07788cad1152
- MD5 e275b9c5bb634784817e60bcee4e16d2
- SHA1 ad5899ffdd0d8f3231959acbfb38066a3503dee1
- SHA512 e770472b260338e11dd3fa2b6229db9e80221c36e3c4d13e253a49e09be83e639987cada4b78f1a7a36e92ddb82d585d9f2bee4ddadab9b02a934aaaa8eb2f12
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGRv5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5M:A3kMhT1LljtpYqOqJtb2I
- TLSH T149855B26F66486B5D073C079C9D2AA5AEA7238420B30CACF1385D7792F277D1D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/3012-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4c3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3012-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/908-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x003b0000000187ef-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0025000000011a0d-1530.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd1-1529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0027000000011a0d-1547.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4c3-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x003b0000000187ef-1274.dat aspack_v212_v242 behavioral2/files/0x0025000000011a0d-1530.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd1-1529.dat aspack_v212_v242 behavioral2/files/0x0027000000011a0d-1547.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 908 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 908 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e275b9c5bb634784817e60bcee4e16d2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3012
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 a164c4bcacb6b24349e240cfef6d82f1bfc88feea812ce077aed07788cad1152
- MD5 e275b9c5bb634784817e60bcee4e16d2
- SHA1 ad5899ffdd0d8f3231959acbfb38066a3503dee1
- SHA512 e770472b260338e11dd3fa2b6229db9e80221c36e3c4d13e253a49e09be83e639987cada4b78f1a7a36e92ddb82d585d9f2bee4ddadab9b02a934aaaa8eb2f12
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGRv5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5M:A3kMhT1LljtpYqOqJtb2I
- TLSH T149855B26F66486B5D073C079C9D2AA5AEA7238420B30CACF1385D7792F277D1D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
- Size 2.2MB
- SHA256 279ff020f57137a38643960dcb8c189dc21fd7fc2b8bf9d7f0be94982d3f4f4a
- MD5 2710bf56b0db534311fa8fd1a8ea6ff9
- SHA1 8c7d037c71e642bdec05aab5a95ea0b89608758c
- SHA512 2b5f53e5ae90c0d7c4926dd142a61ce8d57e4c4703459d57332a8cc396b126eb9a86b1ddce4a382f5a4cc5d9befd8b49a135796fb89eb1723b9cf7c2928caea0
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGRv5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5MT3Tdi:A3kMhT1LljtpYqOqJtb2IFTd9CHKyao
- TLSH T185B56C25F7A446B5E073C179C9E29A56EA7238460B30CACF138597692F337D1C93AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$
- Size 2.2MB
- SHA256 585422639cec2587b7a9290542308daea96c149b794cf78395c471ca8c332688
- MD5 db3aa428844af0bcd78cd1743c912663
- SHA1 4ee11773ac1d3c1897ee668aed29dfea0a24574e
- SHA512 03dcaf542327716fb74219a4d7252add025d7290871cecb55da7bb8282d675d2199afc27ee863e34ee5cc93bcdef70f308406bdce92a235e053b3632c6457bf6
- SSDEEP 49152:A3kMhT1LljtpYqOqJtb2IFdjY9L6FtLNw7:A3kMfLtt6leDVNS
- TLSH T1E6B56C26F6A44675E073C179C9E2A656EA3238451F30C6CF1389A36D2F337D1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 2.1MB
- SHA256 07fa6fb4ae001886ed59464edefcaaf871f81dd30d4cb09d6f4b0bb345b13655
- MD5 84642ba0cc61a97ebf912ab18e24903c
- SHA1 356bbd09916f6e04e9fec7d9f1b893611d0d01a9
- SHA512 8628a38159fff3d0f1f2eb137b797c054c81b85745477858fe73f35a16b376ae7bb948f58d2fa4690db41a06af5a74c1a39aa0400ec9bc6f4294a3c01e02fcc2
- SSDEEP 49152:A3kMhT1LljtpYqOqJtb2IFdjY9L6FtLNw:A3kMfLtt6leDVN
- TLSH T1F6A56C26F6A44675D073C179C9D2A69AEA3238421B30C6CF1389976D2F337D1D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 cde767142e5d5223bed09dc359418ab12ffbc0c9f9838c38195cbc474b9a9088
- MD5 61a94728c6eaabfad786d3f2a73e33f0
- SHA1 b44a03e4af8d0ab2e61b1830d6f0ca2a97f2827f
- SHA512 55cc5df2b017e0a8ca9207d392d887cd3b2e0a6c3c5ed3cd47f0bd116ca42c65efa6eb4d1f79cf6893ee04f1609382991a374e95e1848cbc57e447c568609018
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGRv5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5MP0Lel:A3kMhT1LljtpYqOqJtb2IRPji0Aj
- TLSH T111B54B26F6748775D073C0B9C5D2A69AEA7234421B308ACB1385D77C2F277E6893A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.9MB
- SHA256 d207e11fbb650fed3948937a65ce4b16adfb990fa090b7dc0d3fbac105373457
- MD5 c6b97525963c49e5b3f7b3d9aaff3102
- SHA1 f71647cf90b6f8ec45c0c553357c67f1074b332d
- SHA512 0c92e28c3ebbb9f5b8569672500ebed9fb3d4c69ba6464162e293f3530e7e3143d5726497bdc62845aefc0379235fe532980fdd6f34e5fad1de743925f022c9f
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGRv5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5MLF:A3kMhT1LljtpYqOqJtb2IT
- TLSH T104954B16F6A44675D073C079C9D2AA5AEA323C820B308ADF1385B7792F377D1993A731
- MD5 SHA1 SHA512 SSDEEP TLSH