Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 256KB
- Sample260424-nkrtzagt4x
- SHA256 760d51cd967ccdde96df823cdcb9adc5b629e0285c4966ab8910413030218b50
- MD5 f5076260b5e4dbe8b7789f834a67e7fa
- SHA1 3f023a8e8cc1b9dc3c1282ec6736f5429d2b8572
- SHA512 e7152bede81b5b4ee6a76e5b4bfb02140533ffcdefa921cee9ba25929a6f3becd1b57e65948eba5e721dcea624b5637969648411a66645b1976a292058f78ab8
- SSDEEP 6144:yy5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwd:yyL9Vx6ISvO2x9mONvKRwd
- TLSH T12444BF2362C1C076D4631478552997BDABA9AD721361A4C3F760FF266F307E2E23874B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation 2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe - Executes dropped EXE 1 IoCs
pid Process 4384 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\4695c6c1\jusched.exe 2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\4695c6c1\4695c6c1 2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe 4384 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4388 wrote to memory of 4384 4388 2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_f5076260b5e4dbe8b7789f834a67e7fa_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files (x86)\4695c6c1\jusched.exe"C:\Program Files (x86)\4695c6c1\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\4695c6c1\4695c6c1
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\4695c6c1\jusched.exe
- Size 257KB
- SHA256 c2e4a7b90ec2f20db18c09e099ab2bbda9e51572e58ba042ca81ea1802f08c5f
- MD5 f7f675d34e5cee67ab26143936c5d3b8
- SHA1 fe0d6860b89677976206d26ce68b9a739384f426
- SHA512 bf49af5b77990172743691981114750fd31956c351b1f210898f91e6d1e94b97ea4772923fa9e839d63cd648bb482dabac9885b7ad4a3c0b79c8b48caee4cb72
- SSDEEP 6144:ye5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwj:yeL9Vx6ISvO2x9mONvKRwj
- TLSH T16244BF2362C1C076D4631478552997BD9BA9AD721361A4C3F760FF266F307E2E23874B
- MD5 SHA1 SHA512 SSDEEP TLSH