Analysis
- max time kernel
119s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 12:09
Behavioral task
behavioral1
Sample
2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 969KB
- Sample260820-pbf7jszsdw
- SHA256 cb52de150cf26ddb6db26fc03d2540542c410e5b987844089211571a48ba8765
- MD5 a060e43a53a713678c4f430831272dc2
- SHA1 ba18500d86d19aee22631f5410d877c4ac612413
- SHA512 cf7e77b4bb48cb3e4d07cd34056f7f39c0c2861d4d95df577a47145da94a34878d90d50ca14e401ffe254131b01cffaa82ca2c5cb464949b5bdf511ac4fdc01e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdxEzJjc2Bp:A3kMhT1LljW
- TLSH T16725AF13E79004F5E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2096-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c432-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2096-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2768-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c436-324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c80-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001d000000018890-1522.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c432-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x000d00000001c436-324.dat aspack_v212_v242 behavioral2/files/0x0004000000019c80-1279.dat aspack_v212_v242 behavioral2/files/0x001d000000018890-1522.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2768 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2096 2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2768 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a060e43a53a713678c4f430831272dc2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2096
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 969KB
- SHA256 cb52de150cf26ddb6db26fc03d2540542c410e5b987844089211571a48ba8765
- MD5 a060e43a53a713678c4f430831272dc2
- SHA1 ba18500d86d19aee22631f5410d877c4ac612413
- SHA512 cf7e77b4bb48cb3e4d07cd34056f7f39c0c2861d4d95df577a47145da94a34878d90d50ca14e401ffe254131b01cffaa82ca2c5cb464949b5bdf511ac4fdc01e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdxEzJjc2Bp:A3kMhT1LljW
- TLSH T16725AF13E79004F5E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 9fc0a84c8e4525c285718dbb2f830f23d64236a92d5f5e3ee1ad73d5b42653fd
- MD5 8f10d905cf939a6a0a4dc5377f9ee1a5
- SHA1 313083ce9d5340fda5967d6c5e27dc5cb7762e7f
- SHA512 7a8d89b0e7681697e84253405bc69753eb69609faa528610ddb7b41beb837b17c55a1f50b14046d87add2cfbc659d9acb99aa6ea99e5e5d7720ca1fe770a70a1
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdxEzJjc2BJ3Td9CHKy7GZO:A3kMhT1LljUTd9CHKyao
- TLSH T1E8658D52E7E014F8E477863489A64912EBB27C561B70CACF13A8521A1F337D0AE3DF65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b394504eeada7285868ca933bd9e1dc37ed14a57784b2d4582008cf3fd515121
- MD5 dfb927900e5827f5922be5cfe0082271
- SHA1 77ad716242a0d2f67eebaca3d031ce8ec7ae3b7e
- SHA512 8ff505c530e656045a46f076c96e262d340d4021f622347db914e9c7faba01eabc8309b2a6aa0675b0d882908a8d22e94a8015f07528310a07fb9b8f0d6d47a2
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdxEzJjc2BV0Le5ji0hmxNrM:A3kMhT1LljWPji0Aj
- TLSH T130758D16F6B406B5D033C179C9E29A5AEA7138461B30CACF1398D7292F337D19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 993KB
- SHA256 bb4051489d31c4e41d30199c88d6465bb8790c27da31ab415e7a611894d558ad
- MD5 be8e3154e34dde016abaa582579ac7d2
- SHA1 fdd8fa9ad1312bff9fc08c5b3cd19f950af896c6
- SHA512 b3c17a95b44582622cdc6c4dcbb0353d9443420cb394c5b6eed0dfd1fdcea675ac011d3e2da6ccc43b51ebfa528148afbf0b4e41b52403b6f60e04c70bf5c0aa
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdxEzJjc2Bfb:A3kMhT1Llj2
- TLSH T13225AF13E7A008F5E9178134D9E54A12EBB1BC661760C6DF236892252F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.0MB
- SHA256 aa6d10e2d714d9201ed20bd64393f7b890a1b4646efc23c733ad67372cb469d9
- MD5 954c75651db0adf7a0e70bade4412cc9
- SHA1 bc894026594da561d6f2b30d4ab7c0de34b783b8
- SHA512 a830a904e4555ae33a9101e2dae53375c16b0f9ce0ccb1639497c14a5e8b3f81f38820498670aad2cb86a1868e48b8032c9d159476e55ed489266c61d4ffa4eb
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdxEzJjc2B1F:A3kMhT1Llju
- TLSH T19A359D53E6D004E5DA568134CD964A12EB71BD960B60CAEF1368B7262F333D07E3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH