Analysis
- max time kernel
149s - max time network
132s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 23:44
General
- Target 2026-06-01_d9e9c5ea9d993bfa7d693528314ea6cd_coinminer_elex_wannacry.exe
- Size 3.7MB
- Sample260601-3q83rshs21
- SHA256 6cb81454a750241241e4d5b878eca5bf891f59b6ae2da86fcd8894b2a3eefd02
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\SYSdaemon
-
inject_dll
%windir%\SysWOW64\input.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 24 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_d9e9c5ea9d993bfa7d693528314ea6cd_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_d9e9c5ea9d993bfa7d693528314ea6cd_coinminer_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Injector_Stellar16.exe"C:\Users\Admin\AppData\Local\Temp\Injector_Stellar16.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SYSdaemon\Injector_Stellar16.exeC:\ProgramData\SYSdaemon\Injector_Stellar16.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdaptiAgent.exeC:\Users\Admin\AppData\Local\Temp\AdaptiAgent.exe4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\SYSdaemon\Crisp.exeC:\Users\Admin\AppData\Roaming\SYSdaemon\Crisp.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AdaptiAgent.exe
C43B949.tmp
C43B949.tmp
FB4DD5D.tmp
Injector_Stellar16.exe
background.js
content.js
icon128.png
icon16.png
icon48.png
manifest.json
datastate.dll
debug64.dll
madBasic_.bpl
madExcept_.bpl
maddisAsm_.bpl
module_eng.conf
msvcp_win.dll
rtl120.bpl
ucrtbase.dll
vcl120.bpl
Crisp.exe
memory/1456-54-0x0000000057800000-0x0000000057812000-memory.dmp
memory/1456-55-0x0000000050000000-0x0000000050117000-memory.dmp
memory/1456-52-0x0000000059800000-0x000000005986E000-memory.dmp
memory/1456-56-0x0000000050120000-0x000000005030E000-memory.dmp
memory/1456-53-0x0000000057000000-0x000000005703F000-memory.dmp
memory/1456-51-0x0000000000400000-0x000000000044E000-memory.dmp
memory/1456-58-0x00000000500AB000-0x00000000500AC000-memory.dmp
memory/1456-60-0x00000000740D0000-0x000000007411F000-memory.dmp
memory/1456-61-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp
memory/2216-99-0x0000000000400000-0x000000000044E000-memory.dmp
memory/2216-107-0x00000000755F0000-0x000000007563F000-memory.dmp
memory/2216-108-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp
memory/2216-110-0x00000000755F0000-0x000000007563F000-memory.dmp
memory/2216-120-0x00000000755F0000-0x000000007563F000-memory.dmp
memory/2916-291-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp
memory/3360-134-0x00007FF6B1300000-0x00007FF6B143C000-memory.dmp
memory/3360-122-0x00007FF6B1300000-0x00007FF6B143C000-memory.dmp
memory/3360-290-0x00007FF6B1300000-0x00007FF6B143C000-memory.dmp