b1bede4040211fe7112e6cbc876abad96f3e9e5c37a35d648d6e0ac9562ee651

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Size 1.7MB
Sample260423-mb2gdabs3j
SHA256 b1bede4040211fe7112e6cbc876abad96f3e9e5c37a35d648d6e0ac9562ee651
MD5 49d587d88f7e5c9a52ce264e2fd9d722
SHA1 46962ac01b4abaa41bd8d8ce2c2ef4db1bcf9eb4
SHA512 eb3db0e36228afbd13d92d3e7d7e4e37007b7c583f7ec8f9c9cbe8deb4787043a7af6b81d8a722d61ab673d1fdcbbafa0e70e5a37d8383a0143fb3ee82af3cf9
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNO:mbTChxKCnFnQXBbrtgb/iQvu0UHOR
TLSH
T18D85DE252790CD61F36FC07683E16E79B5B329213B33D885AE4855312BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
2604	WdExt.exe

Loads dropped DLL 2 IoCs

pid	Process
4692	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
2604	WdExt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WdExt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4692	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
4692	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
2604	WdExt.exe
2604	WdExt.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 5028	4692	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe	87
PID 4692 wrote to memory of 4300	4692	2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe	89
PID 5028 wrote to memory of 2604	5028	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_49d587d88f7e5c9a52ce264e2fd9d722_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WdExt.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
Size 1.7MB
SHA256 b1bede4040211fe7112e6cbc876abad96f3e9e5c37a35d648d6e0ac9562ee651
MD5 49d587d88f7e5c9a52ce264e2fd9d722
SHA1 46962ac01b4abaa41bd8d8ce2c2ef4db1bcf9eb4
SHA512 eb3db0e36228afbd13d92d3e7d7e4e37007b7c583f7ec8f9c9cbe8deb4787043a7af6b81d8a722d61ab673d1fdcbbafa0e70e5a37d8383a0143fb3ee82af3cf9
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNO:mbTChxKCnFnQXBbrtgb/iQvu0UHOR
TLSH
T18D85DE252790CD61F36FC07683E16E79B5B329213B33D885AE4855312BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WdExt.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
Size 1.7MB
SHA256 f009049d1b11cf9854b1ca4ee034b689bd8775ac9d75116545d6b317058f1184
MD5 6a575e64c8b104437667b89cf272d75b
SHA1 9dd73c141c61cee1cb7351ecc52329b5449cc4b4
SHA512 2be66d74887726fed6fb10713794ba4aad17824c5c18e680bce59662d8f82859174d894d505e3b18a6fdc7515c6a13c6cb7ec05d1baf1be3a457ac2d22340aaf
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNn:mbTChxKCnFnQXBbrtgb/iQvu0UHOC
TLSH
T1F585DE252790CD61F36FC07683E16E79B5B329213B33D885AE4855306BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin0.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
Size 129B
SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
MD5 d1073c9b34d1bbd570928734aacff6a5
SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
TLSH
T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
MD5 SHA1 SHA512 TLSH

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 358B
SHA256 8340b5b60e1f3a5beed26dd3c4461ca2803019b0fe91d1f33ee6adbd9863ba38
MD5 ef481cee3e0e773924edc68fc168b35d
SHA1 4b7fc9fe8f52e4f1e09e3b636a68b4e3b7fdd137
SHA512 ed066b2770dbc2d66d2100c1c6c39278909f5d727c3a6945f5c4b52176748330e6dc25941e7bae647b0b4d9df0cdaf3a1f7918fe8445ab8e4bc458acf6a4716c
TLSH
T16EE0C04403EEC3EA3110B2EF27E0F07CE22826B53F8817464332D184629054CB952170
MD5 SHA1 SHA512 TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 c67ed34d9254b31e611ee830125c3f2572a1e686f82deb69e1580fb9a4614cd0
MD5 e1e47695a0b98432911311352b63eaed
SHA1 836142e550301e0fc13c1a047aae5a2f4481d7cd
SHA512 da49234ee2e1d8f9956ba59d4a49fe04d3ab154f5dd60cf7a6c72e9d42defe8a4b0aeb38845444fe3a8d9c80976467d2101f7c992a48f98f6a9317d0e61ca961
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyz:/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
TLSH
T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 26950da09a736a90503419a5253dfbb9bcc061b22724b6f499bae56c4db16e45
MD5 c3125a26d4cc87ed2e9818a291e89cab
SHA1 ef4347af4b5aa36fe85a5fb3d5f581f1efbe9b1a
SHA512 5d3cf9dbaed71a87d457adabd4eaa1c4bdf26d27348c83ef5cb1fa2fbd66b6e10735d5cfa06229df9f11b3bafbe4e46bd843746819dfe243420e296e68fbe44f
SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3Cs:RyRznmnp5SedNJBCs
TLSH
T11D842A12BAA58025D6B30674263DA637E4397C710F94EEDB73250F6DE830BC1DB79A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2604-266-0x0000000000740000-0x000000000081C000-memory.dmp

Download

memory/4692-0-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/4692-187-0x0000000000910000-0x00000000009EC000-memory.dmp

Download