Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 453KB
- Sample260730-fnnygstthy
- SHA256 05c2254aac9b9852a9b00353b1fa10055f21c4a4abd3029ac0329529586b0e16
- MD5 b950555059c258285ee7897c70ab1c7f
- SHA1 cbffdbb240fe88e881651796934b69884ea57277
- SHA512 57b500d0f2a2fd5c3dcd9568fb1dc956215067e388d6dc9af1b0a6f49959c644e207b1805170f7bc8878dc6a11b6f24bc5abd17cf66f18740339646385a409b7
- SSDEEP 6144:ye5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/sq:yeL9Vx6ISvO2x9mONvKRwLSFQry/sq
- TLSH T130A48E36AAD0C036D473457584A587BAFAA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation 2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Executes dropped EXE 1 IoCs
pid Process 3412 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\34cfafba\jusched.exe 2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\34cfafba\34cfafba 2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe 3412 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3412 2696 2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_b950555059c258285ee7897c70ab1c7f_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\34cfafba\jusched.exe"C:\Program Files (x86)\34cfafba\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3412
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\34cfafba\34cfafba
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\34cfafba\jusched.exe
- Size 453KB
- SHA256 de6665524ac35d70253c4a589fee9271025839e183db890bb3976a8d147e793f
- MD5 c357c3ad76561dc32a7ea191a31e8f85
- SHA1 bb6fa26bdf5179f46c5c19d0fd45c943c07c7408
- SHA512 0cf599a99999e90587d1208d096a0b844b9166dff2a385baaaaed478b45786f29e8e98ae0f670412572b54c339bce8d554cf81e3e7f9ce1365e5747a131da835
- SSDEEP 6144:yB5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/sv:yBL9Vx6ISvO2x9mONvKRwLSFQry/sv
- TLSH T179A48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH