79c4abdc15b49afe2d7a121b6f4d2c5f00bed31a6935ba75250d2564d9d5b26e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_d9c8200b781375f116f27453bdbd8108_coinminer_elex_phorpiex_sality_wannacry.exe
Size 93KB
Sample260712-y7mtmsgv8n
SHA256 79c4abdc15b49afe2d7a121b6f4d2c5f00bed31a6935ba75250d2564d9d5b26e
MD5 d9c8200b781375f116f27453bdbd8108
SHA1 2588b839e0ac633f361028776dacad7b9b8eab8e
SHA512 baf33195eb700d1db473b65ad5b3aef77624c641e60e1fc3f7af378976de55c994fe662822b11a53de4b9eec455e754f5c7d07f2e0c00c206fa4fd25aab3e09f
SSDEEP 1536:d3AZejZqUK8/6Q8pzcOZxouNWmlDjixObcracM9kYQvF9:mQZqT8/Gpz57ouNWQjT8jakYQvF
TLSH
T1FB93E04EBB981B1FE5A50C3035B542FD86F7AFB622D8C55EFBB04D462978251B81830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/memory/3352-0-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral1/memory/3352-0-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/memory/3352-0-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/memory/3352-0-0x0000000000400000-0x000000000041B000-memory.dmp	UPX

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_d9c8200b781375f116f27453bdbd8108_coinminer_elex_phorpiex_sality_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_d9c8200b781375f116f27453bdbd8108_coinminer_elex_phorpiex_sality_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_d9c8200b781375f116f27453bdbd8108_coinminer_elex_phorpiex_sality_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3352-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download