Analysis
- max time kernel
150s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 452KB
- Sample260416-d2b5qsas5x
- SHA256 e6463493f52247ab7532f86a32c10c57eab27594d6cbe4572dab4de370c32254
- MD5 8193a5f785cabc0efe4ee24153ba3fc9
- SHA1 c9614e1e71d53b6b233d9a298272d97c6c725dcf
- SHA512 80df1ae1bc4677b25e8f9384e0c8885eb6e6eaf6491797cf586f3dd4668ea2b37d58f0c7eb848ff18a2c5e98a2cd41ed098c7b90e2262b9e53b6c04bf97429fd
- SSDEEP 6144:yG5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkryi:yGL9Vx6ISvO2x9mONvKRwLSFQryi
- TLSH T1A4A48E36AAD0C036D473457584A587BABEA5BD323311588FF391F7191E227E3BA6070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5008 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\42ec4778\jusched.exe 2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\42ec4778\42ec4778 2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe 5008 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5088 wrote to memory of 5008 5088 2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_8193a5f785cabc0efe4ee24153ba3fc9_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files (x86)\42ec4778\jusched.exe"C:\Program Files (x86)\42ec4778\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\42ec4778\42ec4778
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\42ec4778\jusched.exe
- Size 452KB
- SHA256 ac351889d9ad143c494c6c341f23d3ddd00a7ef61186d894f5ba8b0aaf46eb0d
- MD5 df19d53e6d1d30546fcb61b407e08bb6
- SHA1 2fbb1a7f55f98f82acb05f9170b4beaec9a88af9
- SHA512 04bf531ad3a12538b7c465e04f38793a1a0e05a8f97c4c4bb7e3f7a19028f0c8233e5e381459a218bcef0af72a2a1337d5332588b1d1e21174bcea8090e6b683
- SSDEEP 6144:yp5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkrym:ypL9Vx6ISvO2x9mONvKRwLSFQrym
- TLSH T128A48E36AAD0C036D473457584A587BAFAA5BD323311588FF391F7191E227E3BA6070E
- MD5 SHA1 SHA512 SSDEEP TLSH