Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 11:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 453KB
- Sample260801-m6yc7syscv
- SHA256 d6d336036855c607eea6f5cc90f82b55651e2be1075b7731e8ac6310f2aa2064
- MD5 3c8f70c48fdd3f6d4107414cd3f59c03
- SHA1 c66278b1f5fe236f78419ccee400e780f5f5340e
- SHA512 0d0a0bdef63757520d13957adfe51a16a5e38b5a8e369e660fff683321ec923a297c3e68682d1d89107f32af910469fdbabca48ae4f216341a3fd354208df089
- SSDEEP 6144:y15rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/sn:y1L9Vx6ISvO2x9mONvKRwLSFQry/sn
- TLSH T1EAA48E36AAD0C036D473457584A587BABAA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4632 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\77c12e2b\jusched.exe 2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\77c12e2b\77c12e2b 2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe 4632 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2716 wrote to memory of 4632 2716 2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3c8f70c48fdd3f6d4107414cd3f59c03_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files (x86)\77c12e2b\jusched.exe"C:\Program Files (x86)\77c12e2b\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\77c12e2b\77c12e2b
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\77c12e2b\jusched.exe
- Size 453KB
- SHA256 85ce9a2e0396923aad88a2183615ed5809e21430a78cc33112eb50ae335982b5
- MD5 dd269e5a7d0d5a60aaad0dede18e66e4
- SHA1 24d80bce265e12b3fb51f04d292be9b4d0d2fb8e
- SHA512 6afc1123ad4e27cd7662ed814a38172a5f40dbad0be8678a90d7ab863253cea5bab4c7474ce4d4fa4ee4ac5667ff19744f87b93ee4a5e0a62e91c1eb175ad06f
- SSDEEP 6144:yM5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/sH:yML9Vx6ISvO2x9mONvKRwLSFQry/sH
- TLSH T152A48E36AAD0C036D473457584A587BAFAA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH