Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 453KB
- Sample260418-eb56kaav2m
- SHA256 ed10766e061fdb1c9b8035cbd012d18766ecdd0b8d8472dd1033c7f14ac5758b
- MD5 88e2d59b9d9a9fa01c7e35f453eb35c2
- SHA1 39855a27b8898cb4b96616d5a8f7cba46729a0e0
- SHA512 cf9c9fc6447f31a3aeb8e91683fc7014c72ef840bc3552f53f426b14b1e36b0881a11f952bb0e98541f02d8a8c6c596fd6ff7aa1e0c6c071b160a08f915dd868
- SSDEEP 6144:yG5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/1:yGL9Vx6ISvO2x9mONvKRwLSFQry/1
- TLSH T141A48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3856 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\dfe8d70a\jusched.exe 2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\dfe8d70a\dfe8d70a 2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe 3856 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3856 1536 2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_88e2d59b9d9a9fa01c7e35f453eb35c2_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files (x86)\dfe8d70a\jusched.exe"C:\Program Files (x86)\dfe8d70a\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3856
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\dfe8d70a\dfe8d70a
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\dfe8d70a\jusched.exe
- Size 453KB
- SHA256 86b5a611c3903484056ac5eac225f06d821e91931d37d168128cbff290f31280
- MD5 31caed785bceeb5cfef27c7a0009b6a9
- SHA1 b67650942f91dbe4324e25a39083857037466947
- SHA512 7adae8a9dfd8a5b8cadd9fd6d9b06b12b7123a28ef07913a84b12e388864cd45da3eda9a12b5655b31449235460f9e603c9806d24ad574218085cc239a310f9a
- SSDEEP 6144:yu5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/k:yuL9Vx6ISvO2x9mONvKRwLSFQry/k
- TLSH T1C9A48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH