5a91e21d8b77daa6494a1e5ca4dc6467f1478ea83c20f3e9cadc0c57e2402d90

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_01dcd3584ac33f557382516b3d0569d9_coinminer_elex_luca-stealer_njrat_remcos_rugmi_wannacry.exe
Size 1.8MB
Sample260604-nvjlcaev7m
SHA256 5a91e21d8b77daa6494a1e5ca4dc6467f1478ea83c20f3e9cadc0c57e2402d90
MD5 01dcd3584ac33f557382516b3d0569d9
SHA1 5db4a2feb4f9cb8d87d069d2abd6120fe2fda7a5
SHA512 4eb0d6baf09724d32fd2109d1d91955cbc31cfa6ed41c9685a48068c2c6748916276f2c75dcee70cae6ba3fd28d86c5cc1d7d9e9fe63bdc568d4475d111694c2
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVYA+wQXxMysZgjS1hqgSCN:66F0eMpAAYEhpVhwWxRjvQombcty4Fk
TLSH
T1B685AF60E64380F1E97300F2461BE7FA6A389E154021CD6BF7C8FE05BAB5952767A317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1748	original_temp.exe
3844	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
3844	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_01dcd3584ac33f557382516b3d0569d9_coinminer_elex_luca-stealer_njrat_remcos_rugmi_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1748	2360	2026-06-04_01dcd3584ac33f557382516b3d0569d9_coinminer_elex_luca-stealer_njrat_remcos_rugmi_wannacry.exe	80
PID 1748 wrote to memory of 3844	1748	original_temp.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-04_01dcd3584ac33f557382516b3d0569d9_coinminer_elex_luca-stealer_njrat_remcos_rugmi_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_01dcd3584ac33f557382516b3d0569d9_coinminer_elex_luca-stealer_njrat_remcos_rugmi_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\Temp\{27D6DDC9-C28D-46E4-9E86-1C6DE2351098}\.cr\original_temp.exe
    "C:\Windows\Temp\{27D6DDC9-C28D-46E4-9E86-1C6DE2351098}\.cr\original_temp.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.filehandle.attached=568 -burn.filehandle.self=564
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 1d2acf61d906b433ec2c3e4a7041bde8a2db65d25287ef597e81d3b7c61c446a
MD5 4cbbc5dfe70a22cd1d6dc71772d888c9
SHA1 a87738872e7f90bb76e2cd028a7fad06f237a0b9
SHA512 108f8f01afe9d9315773e2500c9cb9e44de1b0d2060c69790312118bdf2607391a7fbeb862421eadd375667c269e4dc38f89149ecd42a34f42e95b12455947e4
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODYA+w6X83npi63iE:26F0eMpAAYEhpThw08XpiMJ
TLSH
T146756B50E7C780B0F97316B04A6BE7FA5634BD228831C92BE7C4EE0979B1951B539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 2.4MB
SHA256 85dd62a34968f87dbc20628f5cb75245ef180a63faa5b29e1d208d0579452c36
MD5 7e8fdb832eae58e6a7e2fa12618abdfa
SHA1 94e7efa6f42b441ad127fc36673b7c0a8bab04d5
SHA512 4b3037d41386b278d058acae098d4da290b4974be2077bab761100954ec162e727eb8b51fc6228cede4af9c2a5abc522809d648edcab59038dd01cf0e324358f
SSDEEP 49152:66F0eMpAAYEhpVhwWxRjvQombcty4FORjvQotoy4Fc:10nAAYEpVhTxRjYFRjY6
TLSH
T1AAC59E31E64280B1E9B301F2561BE3F56E389E185120CD6BE7C8FE197AB58927677307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1731.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1731.tmp
Size 1.1MB
SHA256 326b131eb6c678a8f0cb84e88a82b5863bc4e8fd9631f722cf8fb3e133c156de
MD5 3e8f7c73eabfcd9247d329d8164eddfe
SHA1 e05591a7ebc29513449337a4efaa0b81cdc75e58
SHA512 1821280ed877e68c3907b4c0e0f0096677acccebfa438fc0c707e6bd2e579db33717891e0e9305db912399d7280354b0c99c2d273e043e1cc752d2ba9fb01c7a
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOYA+wV7:K6F0eMpAAYEhpIhw9
TLSH
T13F455A94E68384F1E93310F0465BE7FBA6349E164031CD6BEBC8FE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1732.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1732.tmp
Size 1.1MB
SHA256 f00da1a48b455a17fbb3f89bda8a10acead7ff0bde56f49e7a2d88d42ebf2f40
MD5 e8428ec808ffa6a1384530a51f45d67a
SHA1 325ffad96f2a42ed80cec3135f2baefb269b67e0
SHA512 dbacb3facc06f9aff5316ddbd4ee5fe4203a44cbdc2e89bbe741d9d870b8dfb482a65657fe796400dd29987b9145d0b4e09fa1667c2ff4a130dd6deae5c46810
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcYA+wQP:e6F0eMpAAYEhpChwu
TLSH
T119455A54E68384F1E93310F0465BE7FBA6349E168031CD6BEBC8FE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 635KB
SHA256 21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
MD5 9bd591625766a7330708b2c6380dc1d7
SHA1 18018a3d12278187a8dc26eae538a799511bbdfc
SHA512 58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
SSDEEP 12288:UnMwHskY7gjcjhVIEhqgM7bWvcsi6aVcvIymacGU40vy3W/ceKSHMsiFyY6XN:SMysZgjS1hqgSC/izkfbctjymk4HM5yJ
TLSH
T144D49E32A1614032E6F106B3B918A2347D7CD22867148DAEE3E8ED5D7EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5ade62a557ab9ba897315f1e1bbfef298eef416a6c496e6c19e7edfbf9514407
MD5 5c003fd3bf090315f571ddca61b45fd7
SHA1 6d84e709e9103c140f9590998f74772bc5933a68
SHA512 2183ff19c8479bc6d8f04a2451e72185052dccc1bdbd18a5bf0d78ae5f1fd7bee0c79fd49854ab0213bf45c045eb4f3c9e4bbcfc6d092ba884c04a6fdd20c28b
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVYA+wQX:66F0eMpAAYEhpVhwW
TLSH
T189455A94E68384F1E93310F0465BE7FBA6349E164031CD6BEBC8FE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 cf56c7a376a4155e68a802293a3a140ef2efbecbe19366baafc13fc0be9090e1
MD5 05a5b355a5ea243e93e9ff57cc20d639
SHA1 4d7f40538e33316cf1f7e7d23b143f3ca03cf35e
SHA512 9cf86d78562fa4818ca9c8f298032dbb3e4656b2efc75d0c991543580ef8fa52f7573d44bd7cd50574f1edef3eef4326353447aa38994b1565e6795c4f7e1f35
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdYA+wCb:q6F0eMpAAYEhplhwI
TLSH
T10E455A94E78384F1E93310F0465BE7FBA6349E164031CD6BEBC8FE01BAB29527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{CBFC9432-77E7-46C6-B324-1913F728AE5A}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{CBFC9432-77E7-46C6-B324-1913F728AE5A}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-348-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2360-351-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads