macoute | a0a2b0962ea36289a37d98ee12eb69770c00f579f497317afc12523d1d106f98

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/04/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
Size 654KB
Sample260412-e13rqsgt3x
SHA256 a0a2b0962ea36289a37d98ee12eb69770c00f579f497317afc12523d1d106f98
MD5 96444276fd4a7af171ff768ec8d08b88
SHA1 e0c79b6dd540d1e8c1640110d225d3b4d265d49e
SHA512 5ec90e8e13f217fa9fcb035b1519e43937027bf52533c2935cd19498b819d4f6989ef78763ba9458ef5fbc098a81f088d6a1dbabad6ac72ba1e12a3eb729e483
SSDEEP 12288:4aO9sveJhr+FZsveJh+O7tNHwLQqkxmVt7W2pVJTbn7n2kf:4z9hB+jhIO7tNHwUvmVtjTbn6kf
TLSH
T184E42347B44FA0BAF9B41E765F8B3BF745241E111089F846B7A0BE4362ED264D863F06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery macoute persistence spyware stealer worm

Malware Config

Extracted

Family

macoute

87.98.185.184

Signatures

Detects Macoute worm 6 IoCs

resource	yara_rule
behavioral2/files/0x000400000002a738-20.dat	family_macoute
behavioral2/memory/4352-25-0x0000000000400000-0x00000000004D0000-memory.dmp	family_macoute
behavioral2/memory/4352-26-0x0000000000400000-0x00000000004D0000-memory.dmp	family_macoute
behavioral2/memory/4352-38-0x0000000000400000-0x00000000004D0000-memory.dmp	family_macoute
behavioral2/memory/4628-43-0x0000000000400000-0x00000000004D0000-memory.dmp	family_macoute
behavioral2/memory/4628-44-0x0000000000400000-0x00000000004D0000-memory.dmp	family_macoute

Macoute
Macoute is a Windows worm.
worm macoute
Macoute family
macoute

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.bat	sqlserver.exe

Executes dropped EXE 5 IoCs

pid	Process
5092	sqlserver.exe
4352	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
4628	msn.exe
3884	dumpkernel.exe
3648	dumpkernel.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\apo5 = "C:\\Program Files (x86)\\win\\msn.exe"	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kernelfaultEx = "C:\\Windows\\SysWOW64\\dumpkernel.exe"	reg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	msn.exe
File opened (read-only)	\??\z:	msn.exe
File opened (read-only)	\??\b:	msn.exe
File opened (read-only)	\??\e:	msn.exe
File opened (read-only)	\??\h:	msn.exe
File opened (read-only)	\??\k:	msn.exe
File opened (read-only)	\??\o:	msn.exe
File opened (read-only)	\??\x:	msn.exe
File opened (read-only)	\??\a:	msn.exe
File opened (read-only)	\??\l:	msn.exe
File opened (read-only)	\??\p:	msn.exe
File opened (read-only)	\??\y:	msn.exe
File opened (read-only)	\??\q:	msn.exe
File opened (read-only)	\??\i:	msn.exe
File opened (read-only)	\??\m:	msn.exe
File opened (read-only)	\??\n:	msn.exe
File opened (read-only)	\??\r:	msn.exe
File opened (read-only)	\??\s:	msn.exe
File opened (read-only)	\??\t:	msn.exe
File opened (read-only)	\??\g:	msn.exe
File opened (read-only)	\??\j:	msn.exe
File opened (read-only)	\??\u:	msn.exe
File opened (read-only)	\??\v:	msn.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dumpkernel.exe	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\win	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
File created	C:\Program Files (x86)\win\msn.exe	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\win\msn.exe	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumpkernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumpkernel.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sqlserver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sqlserver.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2	msn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 5092	2732	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe	79
PID 2732 wrote to memory of 2580	2732	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe	80
PID 2732 wrote to memory of 1708	2732	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe	82
PID 1708 wrote to memory of 4352	1708	cmd.exe	84
PID 4352 wrote to memory of 4628	4352	2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe	85
PID 1708 wrote to memory of 3884	1708	cmd.exe	86
PID 3884 wrote to memory of 1384	3884	dumpkernel.exe	87
PID 1384 wrote to memory of 3272	1384	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\temp\sqlserver.exe
  "C:\Windows\temp\sqlserver.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-12_96444276fd4a7af171ff768ec8d08b88_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Program Files (x86)\win\msn.exe
      "C:\Program Files (x86)\win\msn.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:4628
- - C:\Windows\SysWOW64\dumpkernel.exe
    "C:\Windows\system32\dumpkernel.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\windows\currentVersion\run /v kernelfaultEx /t REG_SZ /d "C:\Windows\SysWOW64\dumpkernel.exe" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\windows\currentVersion\run /v kernelfaultEx /t REG_SZ /d "C:\Windows\SysWOW64\dumpkernel.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3272

C:\Windows\SysWOW64\dumpkernel.exe
C:\Windows\SysWOW64\dumpkernel.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dumpkernel.exe

Path C:\Windows\SysWOW64\dumpkernel.exe
Size 45KB
SHA256 bbab9383065b21a75aa291f395ae8a3f59cc013e4a865e43be792d7b5b9fc1c3
MD5 620e8fa4a42e2dc3e4294115e56ba62c
SHA1 f2df7f6ae69b480c5aa3372c362bbf5ae80cc4f8
SHA512 4f926e087e6dac7e830d4b65b1a6eae9504a7c758321c202d8001af5632d33c7661fd6dd3c75288f5cd400d16e23536d9a43f9fe4a4acd25360799b502f5be38
SSDEEP 768:7m16Gr4CrJgJUwdOgVx0r7R1DhhSakiAmYgpk8AdJGaoM8ol3/USztDgD3NKb:7m1n4CrSuwbW73hhEiA+pk8oJGap7tES
TLSH
T14E23C097BFA904B1C821227029D77B738A6179D54041F524EB36FCB6A4EE1B0E819E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlserver.exe

Path C:\Windows\Temp\sqlserver.exe
Size 15KB
SHA256 23fea8b183632f91e5a4d1d6a43283846c734eee820eb2084ad428b7cbe92d53
MD5 c83a01f25ea0e1c9200c5893aa2d2199
SHA1 d0c53a1aaf2be6aec7b0f73e767b62fffb010f08
SHA512 3961ce6f4e8871a5032fc5616e057e15892d846270d572f156aebd5557b72cf5dd0139e87306073243b366851e6db09b83f41294a8230836597c2c840e2704d7
SSDEEP 384:y4Od9Q2hJy5g75oOuHh7parHdAI0ptTvzTn:y4aQ2hJyjOuHhntzz
TLSH
T1D3623D5A79479F43C594C0B12B68AB38E7B9B4773D188053D740CE483E7F8819529F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 405KB
SHA256 ca85a5f25f9d1aeccd77b0dfbfb059e06f3842f3806eebe6d495ea7ece530fad
MD5 935bf6389b63665525c681b1f4682155
SHA1 2d31eb4ffd6f553151e0b43bb2bfa92f2acd1d9d
SHA512 e5a194a2fce42948b727fc48ecc75bff7b4983c049d458902f114c07d1e9a243b11ff12461c5eeb495316140b2af7365b9013d8c7691e51b578554839c4c54e6
SSDEEP 6144:cafsiuvAQ+tTm6cyERSiytj71cWE4jKS6v:pCvAQ+q6ctRt636WfjO
TLSH
T12194AE82EBD340F1D8970BB15067B77F9B724B0E502CDD9AD3942E56AC33223992E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\temp\tttbrozzz.bat
Size 582B
SHA256 1acf324d77e807205c7cdc002517dd0aa05643bc7efebe5c3588fa9e632dce52
MD5 a2afc5b8b57732c7c9bce02ca60156ac
SHA1 743d4bfe68e7edf5aef8c33481b6d8490d79901a
SHA512 7505ed20e510a59c604fc84d44e3d1a96914e333f11dc11adf60861bbbfabbac9023d16907a53aacc8c036035d02bb48b29ebbcb79f5cf6c8e269a5701409269
TLSH
T155F0AC2442AAC7FA6824A4D2CBF75A0EF316B426BF45171107504F09A4C041FFE97262
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\temp\tttdelzzz.bat
Size 313B
SHA256 0f8eff970cd19bbf6ea640559973ea104693340d513046134284a73a3083dace
MD5 34dfaff3d1474c876401c4e9e6612c33
SHA1 c0a923aefe1cbbea182cd67164e3e3f1a21557c3
SHA512 a872b4d1c48d1b26c4482d9df6bc59603287d18e12573a324f9635d9f91f93bda770c990c5dd63f0561d5ee277a2a8e08051bcbef170ef90e0913297f253fb92
TLSH
T1A0E07D3819E48BEB9C3560D2C7F31A4AF71A74573E4A03160B114E00A4C005DFCC6152
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2732-17-0x0000000002720000-0x00000000029AB000-memory.dmp

Download

memory/4352-26-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4352-38-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4352-25-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4352-37-0x0000000002A00000-0x0000000002C8B000-memory.dmp

Download

memory/4628-43-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4628-44-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4628-51-0x0000000004460000-0x00000000046EB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads