Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/04/2026, 15:51
Behavioral task
behavioral1
Sample
2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe
- Size 422KB
- Sample260426-taqrtaas21
- SHA256 5a65343027bc5d582c4859c0707f55677a145cb338bb613cfc18a75f43a4306a
- MD5 183b191ad259bf794acadc6d23af97bf
- SHA1 54593e5f78bc91b155966546c3211174a7e868f2
- SHA512 016e8cbbd4f43453d0aabcc968e580784a230933309245ef2f0a0e1b3186492d2295ec1156bea62209cb13499cf021e692135e57418b9f8ba5a230014f4d0d48
- SSDEEP 12288:NO2t0Mipfs3aaB3k6WwuQbfOU0lJakITO:c25ipfsjrsIh0QO
- TLSH T10A94011139E8C6B9D1521532CECD7BE6D2E1D7644E36443723AC4A296F3D84AC30AE7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/1064-0-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/1064-35-0x0000000000400000-0x0000000000421000-memory.dmp UPX - Executes dropped EXE 6 IoCs
pid Process 2864 HDVNCRun.exe 4820 HDVNCRun.exe 4756 HDVNCRun.exe 3152 HDVNCRun.exe 5060 hdvncrun.exe 2256 winvnc.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral2/memory/1064-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1064-35-0x0000000000400000-0x0000000000421000-memory.dmp upx - Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification \??\c:\progra~1\remotehelp35\icon2.ico 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\HDVNCRun.ini 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\MSRC4Plugin.dsm 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\HDVNCRun.exe 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\helpdesk.txt HDVNCRun.exe File opened for modification \??\c:\progra~1\remotehelp35\HDVNCRun.ini hdvncrun.exe File opened for modification \??\c:\progra~1\remotehelp35\sound.wav 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\rc4.key 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\rc4.key 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\HDVNCRun.exe 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\winvnc.exe 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\winvnc.exe 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\UnZip32.dll 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\UnZip32.dll 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\splash.jpg 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\icon1.ico 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\icon1.ico 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\HDVNCRun.ini 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\MSRC4Plugin.dsm 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\cad.exe 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\cad.exe 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File opened for modification \??\c:\progra~1\remotehelp35\helpdesk.txt winvnc.exe File created \??\c:\progra~1\remotehelp35\sound.wav 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\splash.jpg 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe File created \??\c:\progra~1\remotehelp35\icon2.ico 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winvnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDVNCRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvncrun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDVNCRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDVNCRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDVNCRun.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 HDVNCRun.exe 2864 HDVNCRun.exe 3152 HDVNCRun.exe 3152 HDVNCRun.exe 3152 HDVNCRun.exe 3152 HDVNCRun.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 3152 HDVNCRun.exe Token: SeTcbPrivilege 3152 HDVNCRun.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe - Suspicious use of SendNotifyMessage 20 IoCs
pid Process 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe 2256 winvnc.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2864 HDVNCRun.exe 2864 HDVNCRun.exe 2864 HDVNCRun.exe 4820 HDVNCRun.exe 4756 HDVNCRun.exe 3152 HDVNCRun.exe 5060 hdvncrun.exe 5060 hdvncrun.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2864 1064 2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe 80 PID 2864 wrote to memory of 4820 2864 HDVNCRun.exe 81 PID 4820 wrote to memory of 4756 4820 HDVNCRun.exe 82 PID 4756 wrote to memory of 4056 4756 HDVNCRun.exe 83 PID 4056 wrote to memory of 3240 4056 net.exe 85 PID 3152 wrote to memory of 5060 3152 HDVNCRun.exe 88 PID 3152 wrote to memory of 2256 3152 HDVNCRun.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_183b191ad259bf794acadc6d23af97bf_coinminer_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\progra~1\remotehelp35\HDVNCRun.exe.\HDVNCRun.exe /install2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\progra~1\remotehelp35\HDVNCRun.exec:\progra~1\remotehelp35\HDVNCRun.exe -installserviceadmin3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\progra~1\remotehelp35\HDVNCRun.exe"C:\progra~1\remotehelp35\HDVNCRun.exe" /installservice4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\net.exenet start HelpDeskVNCV35⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start HelpDeskVNCV36⤵
- System Location Discovery: System Language Discovery
PID:3240
-
-
-
-
-
-
\??\c:\progra~1\remotehelp35\HDVNCRun.exec:\progra~1\remotehelp35\HDVNCRun.exe /service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\progra~1\remotehelp35\hdvncrun.exec:\progra~1\remotehelp35\hdvncrun.exe /toolbar2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5060
-
-
\??\c:\progra~1\remotehelp35\winvnc.exec:\progra~1\remotehelp35\winvnc.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2256
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\remotehelp35\HDVNCRun.ini
- Size 1KB
- SHA256 6f761e7bb610af6114ca4cf7cb8d7923b8583ddbf59923be5cb3ad114b20fdd1
- MD5 c7fb940ce8e5c622aaa102e303876c1b
- SHA1 640f666f581e8bdd9e812071bb11af6f6b01b35b
- SHA512 4627bd812ca3bce8c650980131239778c6fb9650bfd3ce9acd0054b2ab2dce3e5250fdee60bd7c327517043484b136402b50c4989e4b5da4a5a9524a365f70d4
- TLSH T1E32179F1F022800BF3AB0779810D40024C757E802737B957CA25E6F69D245821ABD8D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\remotehelp35\HDVNCRun.exe
- Size 148KB
- SHA256 a463d7d1780ddc1375bf9e352447fb108f1e7465304313eae323a5891fcb5339
- MD5 d90b2b67797bc56aee2826f74c7085c9
- SHA1 9e833d83e7b12175aa394484005be540a3a7fbef
- SHA512 63c542e3bc45ebd5447f40667e26dfe57173b7775f0839049ac5314bc7c31e9b3f000fb5093ec06cc99503a501acf73dc8b9ab76eb801f5204fa4e6fe4ea3ea2
- SSDEEP 3072:0CdxYR/B1G9Wr3DsS1rhyDzp5mCnWjnqJPTZADQLL4:0d1G9O3DsrDzXmCngnYTZ
- TLSH T147E33B06BAC148F2DB55137248EA33779671FDBD4F254F936358DC2E2C6A180A87728E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\remotehelp35\winvnc.exe
- Size 500KB
- SHA256 f55903167a0aa78efe02f8a46189d2dfd3ed6ee9cf2241a824365b42a38b809b
- MD5 b04b5432fa79e2d74051f6f7ee81efea
- SHA1 3611a7baa0e4ec0087e026c52c6ea65bb5379a2a
- SHA512 8e635622b334a4adc37012bb84ac9476c2048458e252e70f21d24f75c177c6c9e286d6c5e8693bff17c7bbe6cb040b3866fa015f992fdb4b54952323a840b695
- SSDEEP 12288:gU9lBifWhC6Arls42JR6CdiH1m0M8z7PqudgntT6j:z9lYUqls42JR6Cd8c83YtT6j
- TLSH T165B48C4E65C5C2F3D4246435AE36A33DDA3C5EF86B5297C333C8CD8612966D1C2AE722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\progra~1\remotehelp35\HDVNCRun.ini
- Size 1KB
- SHA256 85a20dbd8e1349a04129a9044c573b3e2aae51208b6ce0bb1a30b5f7a80406cc
- MD5 49220b3b02d68eb7794c7ebe4f68d0f5
- SHA1 561cf567f1ec0f85185ecc98fed360d293bb1ef9
- SHA512 83b873174155e05f0db945608c29d3785fee2f18f23928c5d96e7b042d29972841b0ca22d6e3e9557082192177038816052c8e0f71f4766d9b0d1b84105cbd53
- TLSH T1162179F1F022800BF3AB0779810D40024C757E802777B957CA25E6F69D245821ABD8D6
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\progra~1\remotehelp35\helpdesk.txt
- Size 526B
- SHA256 074e78f23ea9e9829dbc76e934b36a548d60eb7352f88d592067c8cbb284a58a
- MD5 46da5663a0275aeae3d70c9ba7aa2c34
- SHA1 d3efd7365f0063b4487e1017f8745080cf60b0af
- SHA512 193f602c6fbb5f32c9a09332531d86ba0be103ad32b8ba1bf7b128205bb5716d188ed4f71ba13145ffcf9f8304830ef5b3410fd60fba99bfcc272b1d5fd06b83
- TLSH T1F4F05906460340EE8FA30181A11E54E17E228A842F86C71351A7B06984F83DAD2FA6CA
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\progra~1\remotehelp35\icon1.ico
- Size 1KB
- SHA256 820dba2bc962d32288239e0e834637381d89c20460f8a9f299f277bd8c8d00c6
- MD5 f2f28a9b65771f4ff31d7f84f5bcd9d7
- SHA1 812617914a36b53bb4a0e3c1db0ce8881b38252b
- SHA512 c590d0f8ff29075cd958ef95c0b38924573cb99735e5e9726bcf8f7b650534e9db6ff31448d781d0120685974fb2f3179cf9b328b3497b1e2f4c91cc836fd590
- TLSH T1FB217222A4606B0BC487A279B0C4AA87339DBD1107E4120B1028ED9B3C29BD3BF36508
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\progra~1\remotehelp35\icon2.ico
- Size 3KB
- SHA256 975a1bd2e5700a105a5d4b05b7bebb1debd4c8eb4e67dd1f31f111787313b1f4
- MD5 d0cf267f77f42f79d01fc3cdfc6c5d9e
- SHA1 f2af030713d7dc038e17f36576b85b6cbcd7570d
- SHA512 a2570f0a7c988b63f39c41c8d297a48ba4d5b9f9ac546146834dc4cb20ba1c57a5b66a67fc1f7a7a1f7405c3661469b219a11d29bb01ba89fc1941c80ae956f9
- TLSH T11B71A5407842D1B2C64126B6CC60C3FE7455DD39CCE82A63FCD2BB2F3E36560A5549B5
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\progra~1\remotehelp35\splash.jpg
- Size 23KB
- SHA256 96f23b537f935b9958b2b991d4ae0e94512b3fd64557af311913fd07f60a1096
- MD5 d0194ab2aebdcce7d811f4938bbf04bc
- SHA1 0f7f7a96311e104a6cc58339d13cfb65389db237
- SHA512 8bb52cff0895c832c301b00057f161054fa4cd2a526cdac8a9702ce6650de07f96f21b0269380224bce368310cca074883931c457121f874304b0d6a8774f76b
- SSDEEP 384:qab4RlSvSQ94DW/T9K+REUiuTKNtD8ztfAnjRxfbFnS05jGmV75Ka5SoYhnS5O9B:hbJvSoSW/wwTi6K7AzBAjLjFn/56O752
- TLSH T16AB2D0268F42EBFBF132C63F01C41C156AC792A3B7094FB99CE7D20D09855A9D522211
- MD5 SHA1 SHA512 SSDEEP TLSH
