Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 08:53
General
- Target 2026-06-02_178a4114893b169bfac54252d3213cd0_elex_wannacry.exe
- Size 11.5MB
- Sample260602-ktrnsahs9v
- SHA256 1c0a50ad25e7b6882fef7195c4105f4aeb111cd1159cd942112858fec8bd4ef0
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\XAML_amd64_stable
-
inject_dll
%windir%\SysWOW64\input.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 41 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_178a4114893b169bfac54252d3213cd0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_178a4114893b169bfac54252d3213cd0_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Data_D.exe"C:\Users\Admin\AppData\Local\Temp\Data_D.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\XAML_amd64_stable\Data_D.exeC:\ProgramData\XAML_amd64_stable\Data_D.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\XeAggregator.exeC:\Users\Admin\XeAggregator.exe4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\XAML_amd64_stable\Crisp.exeC:\Users\Admin\AppData\Roaming\XAML_amd64_stable\Crisp.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
background.js
content.js
icon128.png
icon16.png
icon48.png
manifest.json
AcDs.dll
AcUt.dll
AdMigrator.exe.config
Data_D.exe
InventorServerMarshaling.manifest
SSOClient.config
VCRUNTIME140.dll
ac1st24.dll
acdb24.dll
acge24.dll
acpal.dll
apperr.dll
hcreg16.dll
heidi16.dll
kernel-eng.dat
mfc140u.dll
msvcp140.dll
msvcp_win.dll
plcfmgr.dll
plotcfg16.dll
protocolinit.pdb
ucrtbase.dll
userdata.dll
vcomp140.dll
vcruntime140_1.dll
memory/4356-162-0x00007FFD57B60000-0x00007FFD57BC0000-memory.dmp
memory/4356-158-0x00007FFD57B60000-0x00007FFD57BC0000-memory.dmp
memory/4356-156-0x00007FFD57B60000-0x00007FFD57BC0000-memory.dmp
memory/5300-103-0x00007FFD4F4C0000-0x00007FFD4F520000-memory.dmp
memory/5300-150-0x0000024E9AFC0000-0x0000024E9C0EB000-memory.dmp
memory/5480-164-0x00007FF77E350000-0x00007FF77E48C000-memory.dmp
memory/5480-165-0x00007FF77E350000-0x00007FF77E48C000-memory.dmp
memory/5480-312-0x00007FF77E350000-0x00007FF77E48C000-memory.dmp
memory/5780-315-0x00007FFD673C0000-0x00007FFD675C9000-memory.dmp