Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 17:50
General
- Target 2026-07-09_2ab3e6dd27a55a25c71f54c5647ceb5e_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
- Size 4.1MB
- Sample260709-weshbafx6s
- SHA256 3c583b130c45fa6e9b2350f4cf746ca3b3a4e8e6e3f1a57284b92a2951943107
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 23 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_2ab3e6dd27a55a25c71f54c5647ceb5e_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_2ab3e6dd27a55a25c71f54c5647ceb5e_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@AEB145.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AEB145.tmp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_2ab3e6dd27a55a25c71f54c5647ceb5e_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_2ab3e6dd27a55a25c71f54c5647ceb5e_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
2026-07-09_2ab3e6dd27a55a25c71f54c5647ceb5e_coinminer_darpapox_elex_nymaim_rhadamanthys_wannacry.exe
@AEB145.tmp.exe
tmpB8A8.tmp
tmpB8B8.tmp
tmpB8C9.tmp
tmpB8D9.tmp
tmpB8DA.tmp
tmpB8EB.tmp
tmpB90B.tmp
tmpB91C.tmp
WdExt.exe
Admin0.bat
Admin1.bat
mydll.dll
memory/2864-21-0x000002B600000000-0x000002B600100000-memory.dmp
memory/2864-53-0x000002B603800000-0x000002B603820000-memory.dmp
memory/2864-19-0x000002B600000000-0x000002B600100000-memory.dmp
memory/2864-33-0x000002B613C60000-0x000002B613D60000-memory.dmp
memory/2864-32-0x000002B603820000-0x000002B603840000-memory.dmp
memory/2864-67-0x000002B6144A0000-0x000002B6144C0000-memory.dmp
memory/4804-0-0x0000000000400000-0x0000000000670000-memory.dmp
memory/4804-151-0x0000000000400000-0x0000000000670000-memory.dmp
memory/4848-189-0x0000000010000000-0x0000000010015000-memory.dmp
memory/5924-205-0x0000000000400000-0x0000000000670000-memory.dmp
memory/5924-309-0x0000000000400000-0x0000000000670000-memory.dmp