Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 04:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 256KB
- Sample260503-fer9jsfv3n
- SHA256 8575f6fad176f18183b6a4085e4e6b9b53f2227dfdfa85d484f9426c30b3b6a4
- MD5 a0439a339067b050fdd40d805a89f0d8
- SHA1 6d50875bbaf85201395c5d66a77fa96aa7632b8a
- SHA512 40de5ba4535d8e7b4692d8002d51fda63ec91d597ef2da09254a1fcdecea4d65ba43126ec28295c9d52200b8572b22948fe7e3055134fc7407b716e962dab412
- SSDEEP 6144:yL5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwI:yLL9Vx6ISvO2x9mONvKRwI
- TLSH T18044BF2362C1C076D463147855399BBDABA9AD721361A4C3F760FF256F307E2A23874B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4336 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\b5a4ef7c\jusched.exe 2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\b5a4ef7c\b5a4ef7c 2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe 4336 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4336 4948 2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_a0439a339067b050fdd40d805a89f0d8_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Program Files (x86)\b5a4ef7c\jusched.exe"C:\Program Files (x86)\b5a4ef7c\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\b5a4ef7c\b5a4ef7c
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\b5a4ef7c\jusched.exe
- Size 256KB
- SHA256 284e3af0daa96b74a03602426a1138b681d85e836858e34aa795808983441273
- MD5 461dda13476dd1d839451d2b3c4051a2
- SHA1 2024a104d9fe261204373fcf9752bb44fa8321c6
- SHA512 b6f1960b50bf565ca6b9f8010f0e47d6fdd1fe8dfbef94a2b2bb41724f0920e5c9e8d7a81e3da556cd6727784c32d2625d69b46a03ddd5bcb0732b4f344a2bc3
- SSDEEP 6144:yO5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRw4:yOL9Vx6ISvO2x9mONvKRw4
- TLSH T1CF44BF2362C1C076D463147855399BBDABA9AD721361A4C3F760FF256F307E2A23874B
- MD5 SHA1 SHA512 SSDEEP TLSH