Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 452KB
- Sample260803-m84m1axtet
- SHA256 bdf630ccd66de3790c02843e3840f2689b5615a6445b4a68145aa0b23b5fe3cf
- MD5 bbc33196540bda9b795442c19bdb5351
- SHA1 cbf406c4633a376c121de35765934901c2e77617
- SHA512 b821d5c64c6bdd8f3080a3645ec5d6550cb9a113f1cc37f91ab2c6a004eb458cde78178ce677e4f61b0b0f9c5d8b40e874bcd0ec7949e2a0d1b6343740a5dea0
- SSDEEP 6144:yq5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkryn:yqL9Vx6ISvO2x9mONvKRwLSFQryn
- TLSH T188A48E36AAD0C036D473457584A587BAFEA5BD323311588BF391F7191E227E3BA6070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4288 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\e121d828\jusched.exe 2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\e121d828\e121d828 2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe 4288 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2564 wrote to memory of 4288 2564 2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bbc33196540bda9b795442c19bdb5351_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\e121d828\jusched.exe"C:\Program Files (x86)\e121d828\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4288
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2224
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\e121d828\e121d828
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\e121d828\jusched.exe
- Size 452KB
- SHA256 b2622b4b58322ad067520bd2ad1818d3920812b136ce689702abe71d20ac2017
- MD5 134f465b7373194dd0a2f4467246e3fa
- SHA1 ad7c490a4f8cbe8bb5d1346c38ee28c078dc09fc
- SHA512 9ce3cebb4230f202fde2466a2a1fda537db8585b3b73394767f82e9b45b5f5a97c6739e550ea6e31d5ef939fb09c793847466d2e59cad8506ddb1bff07dc0738
- SSDEEP 6144:yK5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkryu:yKL9Vx6ISvO2x9mONvKRwLSFQryu
- TLSH T1DBA48E36AAD0C036D473457584A587BAFEA5BD323311588BF391F7191E227E3BA6070E
- MD5 SHA1 SHA512 SSDEEP TLSH