Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 13:51
Behavioral task
behavioral1
Sample
2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe
- Size 605KB
- Sample260925-q58dkatvbw
- SHA256 ba77e74e3e89367ffd2ce3c4d754c52b5f410a55a920970382148e4f0f452bcd
- MD5 1e788750ae7bc8fb45f5947e3b3a0a9a
- SHA1 c6410feb77d9de497edffd0b8ad52394f10f09bc
- SHA512 653c85a4c5430656d1e6771675fc5f371e85bbf209276da3217df7b1b124d3361f28c76c344928ed4daa749870e837a579c8305de21afa075d7fe8e2c1336b1e
- SSDEEP 6144:glE19fAf957zj1+OKektnc0AovOrPXPWXPGxj7S9BcHmD1tYFLqY/W5R02qO7Vrh:wEPfAl5gfTdvOrPXPWeB7S9uaYFLq3O0
- TLSH T1DCD40780EBF945D4F5B3AA7899B68571EA76BCAA5E31C20F2154D11F0E33A80DD24733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4620-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral1/files/0x001900000001e58d-4.dat family_cosmu behavioral1/memory/1740-8-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral1/files/0x00070000000242ee-11.dat family_cosmu behavioral1/memory/4620-546-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 5 IoCs
resource yara_rule behavioral1/memory/4620-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x001900000001e58d-4.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/1740-8-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x00070000000242ee-11.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/4620-546-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (5132) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1740 Zombie.exe 996 _LICLUA.EXE - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\fi.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\eventlog_provider.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\README.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.Core.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.EventLog.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DISTLSTS.ICO.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationClient.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PMAILEXT.ECF.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-black_scale-100.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Threading.AccessControl.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDCNCL.CFG.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4620 wrote to memory of 1740 4620 2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe 86 PID 4620 wrote to memory of 996 4620 2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_1e788750ae7bc8fb45f5947e3b3a0a9a_cobalt-strike_elex_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\_LICLUA.EXE"_LICLUA.EXE"2⤵
- Executes dropped EXE
PID:996
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-240542094-4193773837-3211495583-1000\desktop.ini.exe
- Size 26KB
- SHA256 06d1831508e512dad4407e69084dd56dbbee7f63038ecb064c7609bab5729c01
- MD5 964f6168d7f8b1b2ae5a061b2017417c
- SHA1 489162742bca73a287d9d0efa2df88317332cb91
- SHA512 19110385f825228ff3f9ff76b1f830eecdb8e8ff94b90eeb1c0dc04f89c50d34e27b8b7390a443cf0226b0fcb77c2342447ddb5be8c62f4f3b8bbe5271299eb3
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3KzpsVvUaWq9C7c:d7BlpppARFbh6qnpim2X
- TLSH T15CC24B1E8B098033C35550305C2FA8B9DCB7543C7F669A6FEB578C2E6AB63D0F829119
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_LICLUA.EXE
- Size 579KB
- SHA256 45b570950e57b3c2e8bb7b00f2732c74cf07b0230dadd87f64655e7439c9205a
- MD5 a0530c413e605eb5c9be397e64ec3c49
- SHA1 4d8c7845cbc8c96412f313c6aa406b096a3fe9ae
- SHA512 e1827b25ab0820b62354994c57c6ed144a7ad38755c2ea382f252b7b06effd164818e530e1952be199ab79698c59611040ee9dddee1a1fc3d74d7e90a416821d
- SSDEEP 6144:P19fAf957zj1+OKektnc0AovOrPXPWXPGxj7S9BcHmD1tYFLqY/W5R02qO7VrC+:PPfAl5gfTdvOrPXPWeB7S9uaYFLq3O
- TLSH T1C3C4F780EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2154D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 25KB
- SHA256 d257d97ae5e409c10a5e9f9894cc98395cb8f8e90bd17fbef199250e4e9af16c
- MD5 4873419fd2d7be882d2348cb12d2b1a9
- SHA1 24082223446d0e8a266ae4b6ecc9efb63cba48bb
- SHA512 f1a524aa2fe9595ea815055a16bc8894d9f7e78050e4bf5565c3baa59fdea3791dbc2c88d312966d21a0231fc6ea58d31c35be7efa37bae650fc06398813f7c0
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3KzpsVvUaWq9C7c:d7BlpppARFbh6qnpim2r
- TLSH T1D1C24B5E8B098033C39550305C2F68799CB7583C7F66DA6FAB178C2EAA767D0F829119
- MD5 SHA1 SHA512 SSDEEP TLSH