General
- Target 2026-07-28_9ed5bfe15d126abeaa7b42d4f257dc91_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 1.0MB
- Sample260728-ctfbraee64
- SHA256 e3fe4222cd26ae40a490f99e4136f24a72b361038b476a67df57c8206830fd89
- MD5 9ed5bfe15d126abeaa7b42d4f257dc91
- SHA1 212b00d6bf4a9fc9f65ed50938047b3b362f66fc
- SHA512 8343e4b3848db3cbd792d1e24cccd5366a28e73748c867f261b5a1934aaf90d357db794318208ecd8bb6b4993e370d7d9e284fb5914c6c31e6d1588d85787256
- SSDEEP 24576:hxGRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGedP:+8TjFJspDLoVMgdkLdP
- TLSH T15C25E0162780CCA1F26FC07246D06F34B6772E212733ED4A6A4876391FF2A5FE792156
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-28_9ed5bfe15d126abeaa7b42d4f257dc91_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-28_9ed5bfe15d126abeaa7b42d4f257dc91_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-28_9ed5bfe15d126abeaa7b42d4f257dc91_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
- Size 1.0MB
- SHA256 e3fe4222cd26ae40a490f99e4136f24a72b361038b476a67df57c8206830fd89
- MD5 9ed5bfe15d126abeaa7b42d4f257dc91
- SHA1 212b00d6bf4a9fc9f65ed50938047b3b362f66fc
- SHA512 8343e4b3848db3cbd792d1e24cccd5366a28e73748c867f261b5a1934aaf90d357db794318208ecd8bb6b4993e370d7d9e284fb5914c6c31e6d1588d85787256
- SSDEEP 24576:hxGRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGedP:+8TjFJspDLoVMgdkLdP
- TLSH T15C25E0162780CCA1F26FC07246D06F34B6772E212733ED4A6A4876391FF2A5FE792156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2