e612299e82b8fd9ea04965454d632ee88501d095e2ab11b96c1d5ad994a6886c

General

Target
2026-08-06_e9c75c5e91fadfe305d349e5e3c780fc_elex_wannacry.exe
Size 1.1MB
Sample260806-bfhdhsbk2z
SHA256 e612299e82b8fd9ea04965454d632ee88501d095e2ab11b96c1d5ad994a6886c
MD5 e9c75c5e91fadfe305d349e5e3c780fc
SHA1 04449f2b054492592381242ae62a44036534f16f
SHA512 c97134027fc3d7f508cef211da313e77bbb12288fd9a4852eec8098773207baf7fec1b26ea138ff8fae7ada9bedc936b2091d5baaca648d89d54e516e0e6736d
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhwA+w+Ar:76F0eMpAAYEhpIwhwfr
TLSH
T177456C94E78394F5ED2315F1044BEBFBA5309E194032CD67FB88EF10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2888	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_e9c75c5e91fadfe305d349e5e3c780fc_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	original_temp.exe
2888	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 2888	5564	2026-08-06_e9c75c5e91fadfe305d349e5e3c780fc_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_e9c75c5e91fadfe305d349e5e3c780fc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_e9c75c5e91fadfe305d349e5e3c780fc_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXAD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXAD7.tmp
Size 1.1MB
SHA256 819879a5db1e2b13a6b7bbc74245e063c0a2d2aec36cdbd5a2a7b5494375ef85
MD5 2b09b7fec4720bd35ecfed28b0fc8ecc
SHA1 8b44cecd18fcd8413d60220627f261119a0256c9
SHA512 c499ecc845319525f0614d6cbfbebaa52024de8338217cb688812546ea76649007f175b2167038118a9ab280d52cbc256a4d840fb2eb096c44a5fb690daf3f4a
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOvwA+weN:b6F0eMpAAYEhpOwhwi
TLSH
T15B456C94E78394F5ED2315F1044BEBFBA5309E1A4032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 789d762c7ee9ec3ec08196438c115a375cec04ca4d9c3fdad86a834c566b59ff
MD5 eccc9bd7fb29268e831c75b89190d521
SHA1 34db71028b48fea8d011619e7bd6b940c3138bb2
SHA512 826b943fd7664d95f38851b48cb7c117485a7476c8dd1c6987d1f1bb4776bb70b7e89cbc62d7ea02c756f309c30c0b87967ed1f707725e6fb0b237a2deb76d3e
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhwA+w+A:76F0eMpAAYEhpIwhwf
TLSH
T171356C94E78394F5ED2315F1044BEBFBA5309E194032CD77FB88EE10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 44a000b8ff1281ca2c11b14418f5d5e09dc420254d87ab2210d8ec9d7cd28720
MD5 0fed6014ce27e5fde85899f7b1c75c8c
SHA1 2e928300261a0c1962310f71d5196575fc51f8af
SHA512 8a1d96e7a75a92d1096dfdad4d7402168cc55f9e00cd5f5868abd11eb40d436793900b45cc6f08375d35d2f5726e0487add7089783404a1238b780382b922124
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgwA+wME:b6F0eMpAAYEhphwhwF
TLSH
T18F456C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 0b930430837bd42be4710a14044b2b35826501dfe28ad3d0031e0ab19a0ebfad
MD5 be36e5943fa7459cd545b69fd1b255f7
SHA1 d3edd5b9155670021ece2876768ab5434f9b2791
SHA512 1736cc9a105f0a4e682624ded54371b3e7761b6e0b23b57975b1b9d6534d6365939294aec1f77b666df90ebafb888211cab79912814281644aad606e3f95492a
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpwA+wyR:b6F0eMpAAYEhpowhw+
TLSH
T1D1356C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 0dca1a50ebd6faeb882a8275b505cf7381248891f36f82788b0ef1acd2bb03ca
MD5 813b1d5fb8e906c7e545366bc731b9d7
SHA1 15c044151d39e1a300691d303ca2c12f9b43e415
SHA512 9c840c1258f377b368205d67875ea3f110c751255115f261653b5181a303fc19b857dcefddaf7d9f29545b8621bbc0ddfa78b6e158bd58eb8af82925a7a50578
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8wA+we1:D6F0eMpAAYEhpxwhwq
TLSH
T1D0356C94E78394F5ED2315F1044BEBFBA5309E194032CD77FB88EE10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5564-151-0x0000000000400000-0x0000000000528000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads