Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 00:00
Behavioral task
behavioral1
Sample
2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe
- Size 81KB
- Sample260818-aarjkabl21
- SHA256 32571b6b11615838d1d3bfbeb63f02022387484b1fc83d7beb2af759df922495
- MD5 ac493ef8bb5a4a15b929c60693323d04
- SHA1 e4bc84aa1c4d1a72268e35289ebebad0076126c5
- SHA512 009df39a4033c1e3e020d8692c8ced141a444376df54daab1555b6eb207f51936a9274eba4d4c47a9da3eb7599d53afaf557e4f20b15a4fa0c51d9b03b7557b8
- SSDEEP 768:d7BlpppARFbh6qNpim2hE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJu9zVB8:d7ZppAp6qNpH+I8K/XCKCGSqzVS
- TLSH T1A5839E0A9BA940E6D1574170C9A35A6AFE7AF4122F11D6DF0FA8C9191F633C0EE3D316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4812-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral1/files/0x00100000000231f3-6.dat family_cosmu behavioral1/memory/1368-8-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral1/files/0x00020000000233b3-13.dat family_cosmu behavioral1/memory/4812-24-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 5 IoCs
resource yara_rule behavioral1/memory/4812-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x00100000000231f3-6.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/1368-8-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x00020000000233b3-13.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/4812-24-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4962) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1368 Zombie.exe 5496 _createdump.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\be.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\preloaded_data.pb.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMeetingReqRead.nrr.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\wpfgfx_cor3.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4812 wrote to memory of 1368 4812 2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe 84 PID 4812 wrote to memory of 5496 4812 2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ac493ef8bb5a4a15b929c60693323d04_cobalt-strike_elex_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\_createdump.exe"_createdump.exe"2⤵
- Executes dropped EXE
PID:5496
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3053180483-1881419501-3594244048-1000\desktop.ini.exe
- Size 25KB
- SHA256 62eb80eb517c2f26b44937d8ff8590b0bb9d2c464a66b49c5183034999e7dff1
- MD5 2f53c5d9c2b37d711bf421f9c07e7ac0
- SHA1 1eeaeead8940f295fc615ecf6e22319e849d628e
- SHA512 6b8b629d7a9f7ca7119637e6d4584db42d07b5a326ea01305b7464d9085c19dd7cbbce95cd284a8e4bfbefd1cf128dc07235156aa38dd1e425c1b5f8a6501ae2
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3ENzpsVvUaWq9C7F:d7BlpppARFbh6qNpim2W
- TLSH T135C25C5E8B49C032C38550306D2F687DDDB7403CAE26DB67EB568C18AAB63D1FC3815A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_createdump.exe
- Size 56KB
- SHA256 5113e7ae92f3a7aebc7f8e363209866d4d743b06a26c67e0886979a56fd3a10d
- MD5 a05b36f6129223951282f9df776761b1
- SHA1 ec87fa41a670cffa5d77f64366fe109278661f2c
- SHA512 38b588b28057994305a3abc37d98770ab7ff905cba6da35e91b2936b99823955fc91b90a23174d53337dd62e320b9bac066b76734bf657de9fad6d37071c70da
- SSDEEP 768:dE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJu9zVB:c+I8K/XCKCGSqzV
- TLSH T11E436B066BB900DAE05B81B0C5E25A4BFE79F552235196CF0FB8C21A1F637C09F39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 25KB
- SHA256 3f2894862e5183025c7d8e8d4735d61e426ec552a496478e44853242cc6c6292
- MD5 6180698b7230dd53eb427c89f215d5b2
- SHA1 dab048bdbe7403d132ac6dbdb3fc9fd0eee907c7
- SHA512 44ed8db6a5d99b1c6e9d361d258abaabbdfa39c69736074d96b3aeefdeafbe341f8c66124c6a21bc9647b05a835618eccb824c7eb7101c0d2bf7f34bf9cb292f
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3ENzpsVvUaWq9C7:d7BlpppARFbh6qNpim2
- TLSH T161B25B5E8B49C032C38550305C2F687D9CB7443CAE26DB6BAB568C18AAB63D1FC3915A
- MD5 SHA1 SHA512 SSDEEP TLSH