5a65343027bc5d582c4859c0707f55677a145cb338bb613cfc18a75f43a4306a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
Size 422KB
Sample260426-taqrtaas21
SHA256 5a65343027bc5d582c4859c0707f55677a145cb338bb613cfc18a75f43a4306a
MD5 183b191ad259bf794acadc6d23af97bf
SHA1 54593e5f78bc91b155966546c3211174a7e868f2
SHA512 016e8cbbd4f43453d0aabcc968e580784a230933309245ef2f0a0e1b3186492d2295ec1156bea62209cb13499cf021e692135e57418b9f8ba5a230014f4d0d48
SSDEEP 12288:NO2t0Mipfs3aaB3k6WwuQbfOU0lJakITO:c25ipfsjrsIh0QO
TLSH
T10A94011139E8C6B9D1521532CECD7BE6D2E1D7644E36443723AC4A296F3D84AC30AE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/3204-0-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3204-33-0x0000000000400000-0x0000000000421000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	HDVNCRun.exe

Executes dropped EXE 6 IoCs

pid	Process
2672	HDVNCRun.exe
964	HDVNCRun.exe
1936	HDVNCRun.exe
3364	HDVNCRun.exe
3708	hdvncrun.exe
1740	winvnc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3204-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3204-33-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	\??\c:\progra~1\remotehelp35\MSRC4Plugin.dsm	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\HDVNCRun.exe	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\HDVNCRun.exe	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\UnZip32.dll	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\helpdesk.txt	HDVNCRun.exe
File opened for modification	\??\c:\progra~1\remotehelp35\splash.jpg	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\icon1.ico	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\icon2.ico	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\rc4.key	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\HDVNCRun.ini	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\MSRC4Plugin.dsm	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\winvnc.exe	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\winvnc.exe	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\sound.wav	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\cad.exe	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\helpdesk.txt	winvnc.exe
File created	\??\c:\progra~1\remotehelp35\sound.wav	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File created	\??\c:\progra~1\remotehelp35\icon2.ico	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\HDVNCRun.ini	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\cad.exe	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\UnZip32.dll	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\HDVNCRun.ini	hdvncrun.exe
File created	\??\c:\progra~1\remotehelp35\splash.jpg	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\icon1.ico	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
File opened for modification	\??\c:\progra~1\remotehelp35\rc4.key	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDVNCRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdvncrun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winvnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDVNCRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDVNCRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDVNCRun.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	HDVNCRun.exe
2672	HDVNCRun.exe
3364	HDVNCRun.exe
3364	HDVNCRun.exe
3364	HDVNCRun.exe
3364	HDVNCRun.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	3364	HDVNCRun.exe
Token: SeTcbPrivilege	3364	HDVNCRun.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe
1740	winvnc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2672	HDVNCRun.exe
2672	HDVNCRun.exe
2672	HDVNCRun.exe
964	HDVNCRun.exe
1936	HDVNCRun.exe
3364	HDVNCRun.exe
3708	hdvncrun.exe
3708	hdvncrun.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2672	3204	2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe	85
PID 2672 wrote to memory of 964	2672	HDVNCRun.exe	86
PID 964 wrote to memory of 1936	964	HDVNCRun.exe	87
PID 1936 wrote to memory of 3436	1936	HDVNCRun.exe	89
PID 3436 wrote to memory of 3076	3436	net.exe	91
PID 3364 wrote to memory of 3708	3364	HDVNCRun.exe	98
PID 3364 wrote to memory of 1740	3364	HDVNCRun.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204
- \??\c:\progra~1\remotehelp35\HDVNCRun.exe
  .\HDVNCRun.exe /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - \??\c:\progra~1\remotehelp35\HDVNCRun.exe
    c:\progra~1\remotehelp35\HDVNCRun.exe -installserviceadmin
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\progra~1\remotehelp35\HDVNCRun.exe
      "C:\progra~1\remotehelp35\HDVNCRun.exe" /installservice
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\SysWOW64\net.exe
        
        net start HelpDeskVNCV3
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3436
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start HelpDeskVNCV3
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3076

\??\c:\progra~1\remotehelp35\HDVNCRun.exe
c:\progra~1\remotehelp35\HDVNCRun.exe /service
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- \??\c:\progra~1\remotehelp35\hdvncrun.exe
  c:\progra~1\remotehelp35\hdvncrun.exe /toolbar
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3708
- \??\c:\progra~1\remotehelp35\winvnc.exe
  c:\progra~1\remotehelp35\winvnc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HDVNCRun.exe

Path C:\Program Files\remotehelp35\HDVNCRun.exe
Size 148KB
SHA256 a463d7d1780ddc1375bf9e352447fb108f1e7465304313eae323a5891fcb5339
MD5 d90b2b67797bc56aee2826f74c7085c9
SHA1 9e833d83e7b12175aa394484005be540a3a7fbef
SHA512 63c542e3bc45ebd5447f40667e26dfe57173b7775f0839049ac5314bc7c31e9b3f000fb5093ec06cc99503a501acf73dc8b9ab76eb801f5204fa4e6fe4ea3ea2
SSDEEP 3072:0CdxYR/B1G9Wr3DsS1rhyDzp5mCnWjnqJPTZADQLL4:0d1G9O3DsrDzXmCngnYTZ
TLSH
T147E33B06BAC148F2DB55137248EA33779671FDBD4F254F936358DC2E2C6A180A87728E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winvnc.exe

Path C:\Program Files\remotehelp35\winvnc.exe
Size 500KB
SHA256 f55903167a0aa78efe02f8a46189d2dfd3ed6ee9cf2241a824365b42a38b809b
MD5 b04b5432fa79e2d74051f6f7ee81efea
SHA1 3611a7baa0e4ec0087e026c52c6ea65bb5379a2a
SHA512 8e635622b334a4adc37012bb84ac9476c2048458e252e70f21d24f75c177c6c9e286d6c5e8693bff17c7bbe6cb040b3866fa015f992fdb4b54952323a840b695
SSDEEP 12288:gU9lBifWhC6Arls42JR6CdiH1m0M8z7PqudgntT6j:z9lYUqls42JR6Cd8c83YtT6j
TLSH
T165B48C4E65C5C2F3D4246435AE36A33DDA3C5EF86B5297C333C8CD8612966D1C2AE722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HDVNCRun.ini

Path \??\c:\progra~1\remotehelp35\HDVNCRun.ini
Size 1KB
SHA256 85a20dbd8e1349a04129a9044c573b3e2aae51208b6ce0bb1a30b5f7a80406cc
MD5 49220b3b02d68eb7794c7ebe4f68d0f5
SHA1 561cf567f1ec0f85185ecc98fed360d293bb1ef9
SHA512 83b873174155e05f0db945608c29d3785fee2f18f23928c5d96e7b042d29972841b0ca22d6e3e9557082192177038816052c8e0f71f4766d9b0d1b84105cbd53
TLSH
T1162179F1F022800BF3AB0779810D40024C757E802777B957CA25E6F69D245821ABD8D6
MD5 SHA1 SHA512 TLSH

Submit Download

helpdesk.txt

Path \??\c:\progra~1\remotehelp35\helpdesk.txt
Size 526B
SHA256 074e78f23ea9e9829dbc76e934b36a548d60eb7352f88d592067c8cbb284a58a
MD5 46da5663a0275aeae3d70c9ba7aa2c34
SHA1 d3efd7365f0063b4487e1017f8745080cf60b0af
SHA512 193f602c6fbb5f32c9a09332531d86ba0be103ad32b8ba1bf7b128205bb5716d188ed4f71ba13145ffcf9f8304830ef5b3410fd60fba99bfcc272b1d5fd06b83
TLSH
T1F4F05906460340EE8FA30181A11E54E17E228A842F86C71351A7B06984F83DAD2FA6CA
MD5 SHA1 SHA512 TLSH

Submit Download

icon1.ico

Path \??\c:\progra~1\remotehelp35\icon1.ico
Size 1KB
SHA256 820dba2bc962d32288239e0e834637381d89c20460f8a9f299f277bd8c8d00c6
MD5 f2f28a9b65771f4ff31d7f84f5bcd9d7
SHA1 812617914a36b53bb4a0e3c1db0ce8881b38252b
SHA512 c590d0f8ff29075cd958ef95c0b38924573cb99735e5e9726bcf8f7b650534e9db6ff31448d781d0120685974fb2f3179cf9b328b3497b1e2f4c91cc836fd590
TLSH
T1FB217222A4606B0BC487A279B0C4AA87339DBD1107E4120B1028ED9B3C29BD3BF36508
MD5 SHA1 SHA512 TLSH

Submit Download

icon2.ico

Path \??\c:\progra~1\remotehelp35\icon2.ico
Size 3KB
SHA256 975a1bd2e5700a105a5d4b05b7bebb1debd4c8eb4e67dd1f31f111787313b1f4
MD5 d0cf267f77f42f79d01fc3cdfc6c5d9e
SHA1 f2af030713d7dc038e17f36576b85b6cbcd7570d
SHA512 a2570f0a7c988b63f39c41c8d297a48ba4d5b9f9ac546146834dc4cb20ba1c57a5b66a67fc1f7a7a1f7405c3661469b219a11d29bb01ba89fc1941c80ae956f9
TLSH
T11B71A5407842D1B2C64126B6CC60C3FE7455DD39CCE82A63FCD2BB2F3E36560A5549B5
MD5 SHA1 SHA512 TLSH

Submit Download

splash.jpg

Path \??\c:\progra~1\remotehelp35\splash.jpg
Size 23KB
SHA256 96f23b537f935b9958b2b991d4ae0e94512b3fd64557af311913fd07f60a1096
MD5 d0194ab2aebdcce7d811f4938bbf04bc
SHA1 0f7f7a96311e104a6cc58339d13cfb65389db237
SHA512 8bb52cff0895c832c301b00057f161054fa4cd2a526cdac8a9702ce6650de07f96f21b0269380224bce368310cca074883931c457121f874304b0d6a8774f76b
SSDEEP 384:qab4RlSvSQ94DW/T9K+REUiuTKNtD8ztfAnjRxfbFnS05jGmV75Ka5SoYhnS5O9B:hbJvSoSW/wwTi6K7AzBAjLjFn/56O752
TLSH
T16AB2D0268F42EBFBF132C63F01C41C156AC792A3B7094FB99CE7D20D09855A9D522211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3204-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3204-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download