Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 256KB
- Sample260415-vd8mgag14z
- SHA256 e2a38947ad1547622d2d7fa998dd895d6648778afada2da54aa82499c6c98f92
- MD5 64fb25a758021c0d18fb4170de7ac450
- SHA1 6ae2e02715106879d5ee726ec449dc35c05edb98
- SHA512 849b5656e464bb20e16516688728e21ecaf11282e70d7aeaac6484f419ba7614166a096f75f3e5c096cf859c0d0c9d47a7ae41472a3c4b27e4c527529eab95b5
- SSDEEP 6144:yK5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwQ:yKL9Vx6ISvO2x9mONvKRwQ
- TLSH T17944BF23A2C1C076D463147855299BBD9BA9AD721361A4C3F760FF256F307E2E23874B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1744 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\12e7b262\jusched.exe 2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\12e7b262\12e7b262 2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe 1744 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1744 2280 2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_64fb25a758021c0d18fb4170de7ac450_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\12e7b262\jusched.exe"C:\Program Files (x86)\12e7b262\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1744
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\12e7b262\12e7b262
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\12e7b262\jusched.exe
- Size 256KB
- SHA256 15ab058535a0e54e62e453427e4b1d5cb1627f35dd06d72bfc59c6bcfb71720b
- MD5 830b77e384cfb5f477ac1b705d08c7aa
- SHA1 7ead1566c639a7f180dc5ba96cf4f47c869cc225
- SHA512 f18189300630229f60dccb7129686ce1bd1ea8d38385329fa34cac0d8421ab6bdd7aa4948fdf76a5b9820ba795fdd91519cc6224ea5d33cc4f9c7654eae613f7
- SSDEEP 6144:yQ5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwQa:yQL9Vx6ISvO2x9mONvKRwQa
- TLSH T14C44BF23A2C1C076D463147855299BBD9BA9AD721361A4C3F760FF256F307E2E23874B
- MD5 SHA1 SHA512 SSDEEP TLSH