Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 453KB
- Sample260707-d1d8psd12m
- SHA256 a9e1edd3ebf8adf763fd4381b7e3a1c06a41b85ca0efe7ce901ba85e08f9fdd4
- MD5 6081ddde1ee9c202b85070fb314c1974
- SHA1 c8d982bec3d7d91782e40c6b5b5ec525a1ec0e59
- SHA512 a202c6e46b411a7734085f1a582595a7ff341fca5ab81fdaaa025a8bdfe66ba1e0a06bf8072e291ea177429f720b632ce86bbc3181e1d1935debb542eda833d3
- SSDEEP 6144:yL5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/R:yLL9Vx6ISvO2x9mONvKRwLSFQry/R
- TLSH T14DA48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1512 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\cca51f47\jusched.exe 2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\cca51f47\cca51f47 2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe 1512 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4832 wrote to memory of 1512 4832 2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_6081ddde1ee9c202b85070fb314c1974_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Program Files (x86)\cca51f47\jusched.exe"C:\Program Files (x86)\cca51f47\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\cca51f47\cca51f47
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\cca51f47\jusched.exe
- Size 453KB
- SHA256 46588152834a33bde308dbe0f80d8f7afd5be50b2bdd8c4f62d613e3ea9dc5e2
- MD5 b6970e3673354e6d1449ff7df50a633d
- SHA1 fcbb74e0b1dea61dbc2169e1511f628756380e72
- SHA512 2bb7ea88877996dfa7323c080b03c3dace53814b6703a36dca800f4e10192612db63e435758426bff301bb5c062ef7a2b1d2ea043d4d3a7dc962195761953af5
- SSDEEP 6144:yT5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/P:yTL9Vx6ISvO2x9mONvKRwLSFQry/P
- TLSH T161A48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH