c0d0c440f0d47c8b2b74d3750bbfdbc51ab46f0fc9aa1edf9ff9e95c734a6524

Analysis

max time kernel
106s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260820-22txjsgb87
SHA256 c0d0c440f0d47c8b2b74d3750bbfdbc51ab46f0fc9aa1edf9ff9e95c734a6524
MD5 f24964e9ce2c21ee0c0a1eb71e508182
SHA1 51aaefa3b6a08296f39753239296b304944b609c
SHA512 4197bff294a46ec8f6f4f7a3aebf21be3b0cefea61c1701ee688fc60bdca3d8afd73f472032a9c395f2f3dff443989e9f8093bf87ad4881760c1d2b42151f907
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiI/:A3k03kHRJARJU
TLSH
T1F9259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 15 IoCs

resource	yara_rule
behavioral2/memory/2968-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c578-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2968-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3632-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-422.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-538.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-637.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a573-997.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019c9a-1287.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 12 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c578-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-41.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-422.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-538.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-637.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-760.dat	aspack_v212_v242
behavioral2/files/0x000300000001a573-997.dat	aspack_v212_v242
behavioral2/files/0x0004000000019c9a-1287.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3632	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3632	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f24964e9ce2c21ee0c0a1eb71e508182_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2968

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 c0d0c440f0d47c8b2b74d3750bbfdbc51ab46f0fc9aa1edf9ff9e95c734a6524
MD5 f24964e9ce2c21ee0c0a1eb71e508182
SHA1 51aaefa3b6a08296f39753239296b304944b609c
SHA512 4197bff294a46ec8f6f4f7a3aebf21be3b0cefea61c1701ee688fc60bdca3d8afd73f472032a9c395f2f3dff443989e9f8093bf87ad4881760c1d2b42151f907
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiI/:A3k03kHRJARJU
TLSH
T1F9259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 9bc798a757450820f57a00bc094aa8a93a6e3e3eca4b1e49294bd91b65be53f5
MD5 a426d3893184413f3842494ab820d344
SHA1 318a39667d98e6a745f9bded83e6418da36df9ef
SHA512 1222b4d7075e0ac181a85c9123650fdfc787904612eafbbdb6017618f4c336594aff461b9bcc94c6c6259a5cde5e2802b1657c2fde96fce72b49798bfb4162fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIr0Le5ji0hmxNrM:A3k03kHRJARJMPji0Aj
TLSH
T182657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 955KB
SHA256 a7d2b62ef99da1acca6bac5c93d5278b18424fa1b81500f33c7a586d36c4a2ae
MD5 3812ec4ce247116aedf585c895817d04
SHA1 927fff6f950fbceb2f3622b81fe8cbf7e9e7e460
SHA512 6f701dd7d1bdf9b631f7fe27f39c838f5519a926de50a39a5eef13f941c4d9291abb6df8b653e36b7267ae260e4da253563438407ee8134b557fc207a353b0a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIta:A3k03kHRJARJ
TLSH
T148259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 964KB
SHA256 41b420a3a8e8309a4f90bfc6f836fabc59e90b8b5653678e0b634dbae21da695
MD5 875968da70ba06a1d96ce5091e0a19a2
SHA1 172bf6326b800218e171b69ebc79ca6336e5326c
SHA512 92e88314531d136d46304fef9e493bf9484e010e5af611a249ea209cc5b06b5b9f3f8a0bd24e3a678d07e1bd80816abe92bbf9a39ad714fc1dcfec3edc319277
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIYo:A3k03kHRJARJO
TLSH
T1A6259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 964KB
SHA256 737602a865bb0d90d57d172d680c188beb70f63f0096db7a4048d2a251bcfded
MD5 0efe753d3a1d5420d4997ff122518936
SHA1 bc2a8a8e62e0ccece8569402f940cd14c365a869
SHA512 6aad70b8888236b89cb6f3b63c9334c3db6e3024ea0ea52e89f79c74637c8d4c828597a1164f8b3e0916018db912e60eabb19adfab23ae1ea6cce5f3347ec16d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIr+:A3k03kHRJARJb
TLSH
T10D259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 964KB
SHA256 c31e6d0e88c67e38b94a39ffa3734e6d770d7fbcc37c1f41e2a063b9c1b98706
MD5 2fbc7a4bf27efb4a757c7d5fd0083c3c
SHA1 b7c01b9ce2feb743c8f37f56fb1debb5923afc9d
SHA512 7bc5f5fff6ce7274228ccc46eac9cbdf8cfedd9c88da8d13241a0abcba70907d9b60c8cdbfe0644a21c2f2d25bba0f6d12583f6248d0198855200939fea28ddb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIhQ:A3k03kHRJARJf
TLSH
T18B259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 964KB
SHA256 ede4fbf261ca700bbedcf24f74c45662aea281dc688a1b758c577f11c74d9358
MD5 d061c80032985dcf4bde034563a3e3fa
SHA1 a25b136f0f789af6d0e061f411e879ecb2987444
SHA512 b8c65f77f313565a398a76063611f0e5dd0b29cfd559235cba0b157c20b23ec192eaff7355bd6a51f6f886d63da677aef088d17afd750cd0d94327ae212e0c11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiImX:A3k03kHRJARJz
TLSH
T126259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 964KB
SHA256 2b0352b517d989be0bbf84cc7054f9a346e1babad315e1b642b590d4c1e3885a
MD5 c311968cabbcdb6c392e4e1778eda153
SHA1 1f6f3babac10c5a3c89490c774b44751ac249c2e
SHA512 c4ac8a0a929df479b375eca820ff4eb3077396c6503b9fb5c7b842eec5d21a581b568fb84d4d95f3a8a8532f337392f6d46438159db7ac11ebbea200437a8979
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIgL:A3k03kHRJARJ9
TLSH
T1A1259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 964KB
SHA256 4f0cdb456fa19668eea5a4288d0af0b5eab7ecace9b5d60cc51e6598d610be11
MD5 86ceeeac0bf0e8d3e0c11d040b218fff
SHA1 9f3188168632e8a4f826c37f5d64513ebc1582d0
SHA512 ea72a3892119bf64aa0fa0d9166f28acc19a693da0bbc9cf7637d7b4f2ca27d3fa8658908069a0f0e66a0368dec860c8d04da333a02cbb839476a3d6d5227cea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIMM:A3k03kHRJARJE
TLSH
T1B3259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 964KB
SHA256 5d7baf407d6b7c4cd456dd4938f8d0a75143f51d5cc1e236fc3a415465fd871f
MD5 c25906b5e025accbdb9317edae582edb
SHA1 d87429591ab8eefbab7bfb00289bc5511891c25f
SHA512 420960e53dc5e90444859069470444897c475e0faa3e2abbd37d56d9ebb26a80c2426f938f04c7d29b48db69b4ead821bbbc5384828e5abd8cd73214ad54307e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIVh:A3k03kHRJARJ+
TLSH
T105259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
Size 974KB
SHA256 606833c64cf84e71475651dddb4e42538b17476fca93fca2c8cefd83ca604772
MD5 bb62011be574821f9b347b41e3256d44
SHA1 32a5add8a15042a89b5f1f4634ab2b61da0decb6
SHA512 2f2bf16f3c25e4276c23f8dd62a7d8471b2446e150b1ee58964392324d1020ffd5939c90459329d6a2932a9125166e1329ba0d3300b9041365f955128d3e307e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiIK1:A3k03kHRJARJ91
TLSH
T196259C03F79900E8D15AC1749AA69A22FB757C561730A3DF1358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 1020KB
SHA256 b9fdb8fb6e49be9d5ca43bc3388dee664117ea80aa7ae68e98a25a0f8d5a0082
MD5 0e0a1acd5797f7ff7472c90b61313c09
SHA1 591de00aea77b6ba6e7d5e140a62d006d6bb4520
SHA512 e83b5fd6a59e481a41102f583aa57eca1ec2cf74fc8ede36eecc0125e337bc0bfe577733260123286f2df19e3811d81f5ccb9f3df7e87bd75013c21d6fd90118
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpdGiInF:A3k03kHRJARJk
TLSH
T141258D03E6D500E9D64AC1349E9A8A22FB35BD92072097EF1358B7262F727D0BF39754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2968-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3632-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads