5d57fc4a894bc44dfdeabf4e8d4eb3ebdedcd14aa4519bb990089309c2aadf1a

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_3379e91f423e56e081d71ed8d98d315e_elex_wannacry.exe
Size 1.2MB
Sample260718-katc9sdx9m
SHA256 5d57fc4a894bc44dfdeabf4e8d4eb3ebdedcd14aa4519bb990089309c2aadf1a
MD5 3379e91f423e56e081d71ed8d98d315e
SHA1 873b49c690bfe4e58f50ddd3a3f789aea138ac14
SHA512 10dacc218a53f7ff1d18e629cb3d36607d81e8719ef3d9bd164989eaa6069cb159c91bde036dc484f8fe188b79ee3f0831637ddff302ce228a640fce233ac97a
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtnvviYA+whpw:z6F0eMpAAYEhpkn3jhwXw
TLSH
T1EA456C64E783C4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE15BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1236	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_3379e91f423e56e081d71ed8d98d315e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	original_temp.exe
1236	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1236	2396	2026-07-18_3379e91f423e56e081d71ed8d98d315e_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-18_3379e91f423e56e081d71ed8d98d315e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_3379e91f423e56e081d71ed8d98d315e_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX3CA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3CA5.tmp
Size 1.2MB
SHA256 a0f1e41cab76a7a2fe5748f0edd5b15b2d89acfa186dfb88461e53d80c001e7f
MD5 311f8fb4fa9b44491e3940966082d12c
SHA1 692abf73d52e16f46a8086ae8529a5b35eea92b9
SHA512 2847b128dadd6a8333300509eb53f760f2e7713dd1c173d24fab0791b5031b164ac947a0b289ac4091e28299367f1d34597129e99f045e2591f14351a80d90cf
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjnvviYA+wsh:L6F0eMpAAYEhpin3jhwc
TLSH
T194455C64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB3E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 f1f83adfd1bf6da558602842351eb087f20e0fbfcd80ed1fb26e4bf1ad80ae2d
MD5 755c3b4f32282ffe8bc97daab927a750
SHA1 691f3a2ec9be4c836c4cdb928192c22706c63e57
SHA512 5b0b5b7e6f61b004f2710ea3a7ba42f02e7a2c70c8783aaa3367deac9ba31303dff9917ea6f7f5373ce35015173a40c347c044f148484c9db117cea0ac3de238
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtnvviYA+whp:z6F0eMpAAYEhpkn3jhwX
TLSH
T114455C64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB3E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 1642024388db09503c9a6b5dc6ecb339256bfd24a8f9deca417e48ad5c33eb68
MD5 33c158b3ab164794f4bb4045ca1e9119
SHA1 cdd04905f2dd102ae45790d7bc3c007ddd25e6af
SHA512 7c84ea18180e0ef3702ac996ece2d29c78c350372e5afaa10bde66d71d37f2922567217fb36cc9e168a8f7b389416381e9b6fc52a035190dc8ab4b365c269c24
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVnvviYA+wEY:n6F0eMpAAYEhpAn3jhwt
TLSH
T121455C64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB3E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 c01f53b9e9d95e1cecf87ecb51a225403c1deba9d1e9757842a59d37edef60ea
MD5 1d0c5ad7310b034516143d2e23b97d1f
SHA1 b2ba2e922ee11b0491ce779d757c19f518ef7524
SHA512 149c521733d2604b71f6c49755e503bb7625d47337d7754db1408aa7ab703d23fb59a54b6dd0890f13a0e841e1460c0cf50ccccfccf68d47aac5a39cb8c1a6f3
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOenvviYA+wTF:L6F0eMpAAYEhpzn3jhwR
TLSH
T17C455C64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB3E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-154-0x0000000000400000-0x0000000000536000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads