Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 04:33
Behavioral task
behavioral1
Sample
2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe
- Size 86KB
- Sample260821-e6ks4sgm7v
- SHA256 e0915988300045ff718110a5b8f1a8f343ec06381fc0aae582038faf194676ea
- MD5 593320887a84c9ae8b5f4f037ff97408
- SHA1 073ef2ba58f54b06e5384dd847dc0cfd97de44b4
- SHA512 87b8b14665499234ee11b9e7743ccc7193872c4029d8e197b2f84877ec10b3328276b6a0e2ae8c825d13ed711e767d7f591cd63ce4758c843b054191f4d518b0
- SSDEEP 768:s7BlpppARFbh6qKpmm2T0AE9E2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJuC:s7ZppAp6qKptw+I8K/XCKCGSqzVy
- TLSH T12193AF069BA940E6D1574170C9A37A6BFE7AF4122F1196CF0FA9C9191F633C0EE39316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/6084-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral2/files/0x0010000000019cbf-10.dat family_cosmu behavioral2/files/0x000d00000001c524-13.dat family_cosmu behavioral2/memory/6084-23-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/6084-0-0x0000000000400000-0x000000000040B000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0010000000019cbf-10.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000d00000001c524-13.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/6084-23-0x0000000000400000-0x000000000040B000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4777) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1548 _createdump.exe 4648 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fil.pak.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp Zombie.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\OLJRNL.FAE.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECREC.CFG.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.ReaderWriter.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6084 wrote to memory of 1548 6084 2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe 89 PID 6084 wrote to memory of 4648 6084 2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_593320887a84c9ae8b5f4f037ff97408_cobalt-strike_elex_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\_createdump.exe"_createdump.exe"2⤵
- Executes dropped EXE
PID:1548
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4648
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini.tmp
- Size 30KB
- SHA256 4760df6ad11078dcb04ff17c235b21e45d58aa1ba84a1c28ff8cb8635406e29c
- MD5 65ba43b6ed88d881746aa76c22d52ecc
- SHA1 a6fb908c4445cf9585b11bbd45ae770f81127331
- SHA512 4a9b5f4ce029b5dba255a269175352c6fb4d642b417a7fedc20fd75e617bfee402058fbadc23f45477ea23161e007273323f11534fa320788699039d78327c41
- SSDEEP 384:gBt7Br5xjL9AgA71Fbhv/r+k7ha3pzpsFvUaWq9C7xiWPbMEt:s7BlpppARFbh6qKpmm2T0AEt
- TLSH T192E27D5E8B498032C38550305D2F7C799DBB443CBE269BA7EB52DC1DAAA63C1F83415A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_createdump.exe
- Size 56KB
- SHA256 5113e7ae92f3a7aebc7f8e363209866d4d743b06a26c67e0886979a56fd3a10d
- MD5 a05b36f6129223951282f9df776761b1
- SHA1 ec87fa41a670cffa5d77f64366fe109278661f2c
- SHA512 38b588b28057994305a3abc37d98770ab7ff905cba6da35e91b2936b99823955fc91b90a23174d53337dd62e320b9bac066b76734bf657de9fad6d37071c70da
- SSDEEP 768:dE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJu9zVB:c+I8K/XCKCGSqzV
- TLSH T11E436B066BB900DAE05B81B0C5E25A4BFE79F552235196CF0FB8C21A1F637C09F39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 30KB
- SHA256 178c67f518072716b23044616110a0ff9ea2eb238ca438bdd05c9a5d82af5be2
- MD5 8dfcd2e9743444aaa2b4603cddd50027
- SHA1 762af2a3797eee3d909e8dcae909f07ddd765290
- SHA512 1f792dc1d6313f13cff46bfd5c5dd8fd167215157d348b873587b332f6ad12d0f0c09406e84f33d7cc9281f2c78a3f3002314da2cce6f1e17f29edfbb761437e
- SSDEEP 384:gBt7Br5xjL9AgA71Fbhv/r+k7ha3pzpsFvUaWq9C7xiWPbME:s7BlpppARFbh6qKpmm2T0AE
- TLSH T163E27D5E8B498032C38550305D2F7C799DB7443CBE269BA7EB42DC1DAAA63C1F83415A
- MD5 SHA1 SHA512 SSDEEP TLSH