Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 11:10
Behavioral task
behavioral1
Sample
2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe
- Size 2.7MB
- Sample261020-m94dmacx9m
- SHA256 69161eda9d1b17f6081cb5772aab0503ce7ec6914ba60be6f0610e5e7d109dcd
- MD5 a4cc7df63223584e0966cfc9dae1d351
- SHA1 1a7e1462c57976d1f8da4de93e42ff9b23f5ac27
- SHA512 0fb925a42e54ba50f70b59e8bf3aefe34b2a7ece9b44a005d1a524ef29345e3ef356816e361323e1d92ae90bf9c7466993ba17bf41eea703db516fd293c818d5
- SSDEEP 49152:RPd9ob7ko+4KuUOROgppYq4gjI45TMwwapIgTDPji0YjfhsTbtL:BDIkC6tLapI2jg9sTpL
- TLSH T127D59D16F6A482B5D033C078CAC6965AFE7274550B309ACB1395D77C2F37AE18B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 5 IoCs
resource yara_rule behavioral2/files/0x00160000000115b6-4.dat family_fesber behavioral2/memory/5488-7-0x0000000000400000-0x000000000041E000-memory.dmp family_fesber behavioral2/files/0x001400000001c42d-17.dat family_fesber behavioral2/memory/5488-641-0x0000000000400000-0x000000000041E000-memory.dmp family_fesber behavioral2/files/0x00a300000001acaf-1279.dat family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240704296.exe - Executes dropped EXE 2 IoCs
pid Process 5488 tmp240704296.exe 1332 tmp240704562.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240704296.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240704296.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240704296.exe -
resource yara_rule behavioral2/memory/3576-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x00160000000115b6-4.dat upx behavioral2/memory/5488-7-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3576-14-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x001400000001c42d-17.dat upx behavioral2/memory/5488-641-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x00a300000001acaf-1279.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe tmp240704296.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe tmp240704296.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- tmp240704296.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- tmp240704296.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe tmp240704296.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe tmp240704296.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- tmp240704296.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- tmp240704296.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe tmp240704296.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE tmp240704296.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE tmp240704296.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240704296.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe tmp240704296.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe tmp240704296.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe tmp240704296.exe File created C:\Program Files\Mozilla Firefox\updater.exe tmp240704296.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- tmp240704296.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- tmp240704296.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- tmp240704296.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- tmp240704296.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe tmp240704296.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- tmp240704296.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- tmp240704296.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe tmp240704296.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tmp240704296.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tmp240704296.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240704296.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240704562.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3576 wrote to memory of 5488 3576 2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe 89 PID 3576 wrote to memory of 1332 3576 2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_a4cc7df63223584e0966cfc9dae1d351_amadey_cobalt-strike_elex_vidar_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\tmp240704296.exeC:\Users\Admin\AppData\Local\Temp\tmp240704296.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5488
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240704562.exeC:\Users\Admin\AppData\Local\Temp\tmp240704562.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 3.1MB
- SHA256 6fad4d6a3242f2a0057d93fee9e3f7cf17c0277808944ca083763ec075f4a321
- MD5 c5dfed4ce076fe9e09a744b917bd6d3e
- SHA1 9861100df62ef02ea61faf5f2e5517635332d2cb
- SHA512 a38c40b1c790f4a1c270306bd18ad99512e8c8a268d7fbf46970c855d94abc211836a9ddd66e5f1f720934e966a2fd27a62826350f26a3ab04b0989d1699cb48
- SSDEEP 49152:RPd9ob7ko+4KuUOROgppYq4gjI45TMwwapIgTDPji0YjgPji0Aj:BDIkC6tLapI2jgqjo
- TLSH T182E56C16F6A48275D033C0B9C6D2A65AFE7234451B309ACB0295D77C2F37BE58A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240704296.exe
- Size 2.6MB
- SHA256 73154cd3a7c5f831a32afa9346fab3598ad34b71c51172f2a5588b1f05fa1261
- MD5 6e6c6073f92f527f27d9ce61c8a95c61
- SHA1 b424fd0ec843422be613504237c85cefd1777155
- SHA512 5d6ad666f0e3316702f74b112143d32bac4c4b806162e6a6b6e272a78e6ec3bce109507b159a88115ac42a7c4fb7c450737497e9c35325321f5710d38179989a
- SSDEEP 49152:jPd9ob7ko+4KuUOROgppYq4gjI45TMwwapIgTDPji0Yj:zDIkC6tLapI2jg
- TLSH T127C58D1AF6A482B5D037D0B9C6C6965AFE3234550B309ACB0295D77C2F37BE14B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240704562.exe
- Size 160KB
- SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
- MD5 a51d90f2f9394f5ea0a3acae3bd2b219
- SHA1 20fea1314dbed552d5fedee096e2050369172ee1
- SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
- SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
- TLSH T1E6F36C3139F4C577D2230530CEE86BF5E0F6DA650E2248A733C94B2D6A79995C329E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\MountSearch.exe-
- Size 2.9MB
- SHA256 fd938fe32760978c68aa906a9936843ad506db74700c7561615132d5d7b215ba
- MD5 f771f67360556fd32239134a9a55ba07
- SHA1 c6c902edaa9ec0c0e186047dd5c26d73c2bada3f
- SHA512 982d4502de4d0c98fc1dc1ee6e40bddd6efff82ba38dafbbffd4d66fb62bc99de4939ae9184b488687052e1e6aea21ad7681a081fe108b9ca059bdbfed70a3f0
- SSDEEP 49152:RPd9ob7ko+4KuUOROgppYq4gjI45TMwwapIgTDPji0YjQ79wS:BDIkC6tLapI2jgU7C
- TLSH T19FE5AE16F6A482B5D037D0B9C6C2965AFE7234550B309ACB0295D77C2F37BE18B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH