Analysis
- max time kernel
149s - max time network
120s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 08:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 453KB
- Sample260415-krr7jac16v
- SHA256 d0ce1533e0bf1454b6c73416f271e3332b8cd76104dd6b5333a65a2f23add629
- MD5 e5a2eb205ddb452fded53458a05190e9
- SHA1 f26fe20dd833095e9ee38c94dd59a81b93824d88
- SHA512 37cdf15b2d66fb145387375b6f3f0ded79bd88b31743f9dada773815024afcf1545d40be192a5c34164be4ae8e2f776d97c5569575ea1dae70d9530a1f801164
- SSDEEP 6144:yi5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/F:yiL9Vx6ISvO2x9mONvKRwLSFQry/F
- TLSH T153A48E36AAD0C036D473457584A587BABAA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2188 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\c12f949c\jusched.exe 2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\c12f949c\c12f949c 2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe 2188 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 848 wrote to memory of 2188 848 2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_e5a2eb205ddb452fded53458a05190e9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files (x86)\c12f949c\jusched.exe"C:\Program Files (x86)\c12f949c\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2188
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\c12f949c\c12f949c
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\c12f949c\jusched.exe
- Size 453KB
- SHA256 4c862927dcb3c319028f325a1e9eb73c6a15ee35910fc7424723b7901101795b
- MD5 9fc1983423739fb3d7f397f697e99a56
- SHA1 dcf2e351e3f298f1d00459962ba4c69c86b63862
- SHA512 6f9bdb4b847ba4ee7da8a25f5f28332edd9c1f3f79c421707155794b5811efb14ab0f9fc8ad4625e20a9c3964dc96c3341866864089330f9e9bfea442f878b92
- SSDEEP 6144:yC5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/G:yCL9Vx6ISvO2x9mONvKRwLSFQry/G
- TLSH T148A48E36AAD0C036D473457584A587BAFAA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH