Analysis
- max time kernel
118s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 04:33
Behavioral task
behavioral1
Sample
2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260819-e6wklsdn6v
- SHA256 c6f5ef802e30c2b11c643effa060bbe688188e7c40451de4c35d16ee45f7f20b
- MD5 bb6975b7f6fe59081be5e4380e25065c
- SHA1 3f88b95b2b8165ad7124c1b67e99e5e53e68a120
- SHA512 a2b5eb173e786103cea6192109810fb742d6dbb16b5d11aab2654314293e0a96703ff803fd8a537cad00e39b6a4bdbb36f7c0ba021317ee124659be6930c40f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrM:A3k03kHRJA56rTPji0Aj
- TLSH T1D3756B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/4608-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c498-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4608-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3348-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4b1-334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019976-542.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00210000000198e9-544.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00380000000187ef-1295.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c498-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000d00000001c4b1-334.dat aspack_v212_v242 behavioral2/files/0x0003000000019976-542.dat aspack_v212_v242 behavioral2/files/0x00210000000198e9-544.dat aspack_v212_v242 behavioral2/files/0x00380000000187ef-1295.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3348 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4608 2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3348 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6975b7f6fe59081be5e4380e25065c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4608
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 c6f5ef802e30c2b11c643effa060bbe688188e7c40451de4c35d16ee45f7f20b
- MD5 bb6975b7f6fe59081be5e4380e25065c
- SHA1 3f88b95b2b8165ad7124c1b67e99e5e53e68a120
- SHA512 a2b5eb173e786103cea6192109810fb742d6dbb16b5d11aab2654314293e0a96703ff803fd8a537cad00e39b6a4bdbb36f7c0ba021317ee124659be6930c40f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrM:A3k03kHRJA56rTPji0Aj
- TLSH T1D3756B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 ad5849338739285c7c8ae2c4257287bc48df55f9890e1739466d9439405a88d1
- MD5 e03f8b32ce10dcedf5ca4568a09de7a6
- SHA1 c1fee716686408aab71931ec44149b0b7d901a75
- SHA512 78efce408f4a2409d0655983accf97b6b08192f68801bb5f05a417ae3a93ae33cd6fc5ad31104a923e412c9a99ce3c97a84ccc8d9a3338b659539a7d43a346d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrMD0Lel:A3k03kHRJA56rTPji0AjKPji0Aj
- TLSH T13CA55B16F6644B75D02BC0B9C5D2969AEA723C421F3087CB0355DB283F67BD19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 1.6MB
- SHA256 f7a0da0ed68ec4e25e1427b4a984f8e5bacf41b7b5edb334129180ffccb3e8f7
- MD5 5131abadf0af60fb17b415b5ced41e72
- SHA1 48f26a62b6ff470dab0bb9c8a54ea4534a90b995
- SHA512 ab2c4792d35132b3cae70fd483fcfa99b9109a4db15f5cb439622a806e4e10d7f6520aaaba59f6e2f55d6561b3b8830bfe79306fc442e25e1a523ad5b9df1c5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrMlf:A3k03kHRJA56rTPji0Aj6
- TLSH T1F2756B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F63BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 1.6MB
- SHA256 af6ad6d368c3fa11190eb3ed1e604055dae3117cafabce8fa66a17e91a172cb8
- MD5 31672c37ad95a136c5eddce3fd63f93e
- SHA1 edf9966173a56504d14af26226d3393e808a2fe6
- SHA512 2c3b7658ea049f415a1d0f2eecd7290c9c9badf5556f25197307be47b4af5f777aafb207a29ed40498cef64fcd3f59cc4eae5cf4d01720491acf12ab730143d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrMoW:A3k03kHRJA56rTPji0Ajw
- TLSH T1C2756B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F63BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
- Size 1.6MB
- SHA256 9f1d8e4c3f164173127999293fde94eb40ddd0cfd3b6212e11f1f7362f56bd8e
- MD5 083047e45ab39b08f4ddc2f3d38e2469
- SHA1 de8b2765d01b99ddecc37c42c309b2b1ba73c43e
- SHA512 efca5607853d0138dd391a35580578614754e9c7009876dc51036c0db58176794817b83dea50730d1c9021ec9b66e0eb0c33bc12deee699214fc72252cbd6a2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrM7M:A3k03kHRJA56rTPji0AjP
- TLSH T179756B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F63BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.7MB
- SHA256 5f9e59e8b9a497b6bace681291d3dbc58cfda78afb638d489526c09706baaeb1
- MD5 ce275f89a1add025b2baa4edb61c833f
- SHA1 cb2728860d2bc472889493a82486ebe0ad65862e
- SHA512 7def07d8efff8b03f12e7037b3fa72e5937e8547316b6bafe13bc632ee045172d141b11fa14e0c0f8253012f6638a51fcf8326e85018b0de3d84bdc013356bae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWcKND5TvinrmC0Le5ji0hmxNrMPF:A3k03kHRJA56rTPji0Ajq
- TLSH T1F9854A16E6A40BA5D06BC074C9D69656EA333C421F3087DB1354BF293F337D1AA3A762
- MD5 SHA1 SHA512 SSDEEP TLSH