e0dd5239a5cb4bc500f92fd0c9d67d3705d9adc72c590767d2442ad7729bfd8c

General

Target
2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe
Size 1.2MB
Sample260808-eellbshk7v
SHA256 e0dd5239a5cb4bc500f92fd0c9d67d3705d9adc72c590767d2442ad7729bfd8c
MD5 3388d8c8aab1bc7475140a3d6975fc91
SHA1 15f4490b33c23ef0415a2aa149b69278843ca607
SHA512 8ec891a26299c64d79a31d4188ac9e2de6119eb75fd8b018199a4f9c327259ab4c8f96b1f14fba7f37200503f1dbbfe78032ec4ea283641027192cd319635ad7
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrYA+wWtU:K6F0eMpAAYEhprhwGU
TLSH
T139456B54E78784F1E93310F0465BE7FBA6349E164032CD2BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4796	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	original_temp.exe
4796	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4796	3152	2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 69a4763dbfdc02104548a161d4ab7473ba566f6c01571b4ce3ed07a929661eed
MD5 7e975877542b946a6a1682136a827650
SHA1 b83a200cadfc627e105cdfd834473a6013e06beb
SHA512 6b1694bf0009c09ebe71bc137011163145e7e743d68cf75d4da28c472a9f10bb5bc9d01591382b55c96dcb3eb2bec4fd87caddbb424730eff8cbb5290c12b67c
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnYA+wWFnMYenGJiKEbXWt7:A6F0eMpAAYEhpbhweMPnRWt4+
TLSH
T130758E64E78380F1E93300F1461BE7F66A389E194031CC6BEBC4EF15BA76952767A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.6MB
SHA256 705921e8300a75ae7c6d42993ab903da82e9f558b0ad4bda0e08803ec173a62d
MD5 d534c0480016d52cea7129a774b4d537
SHA1 f587b3b60effde739e4e2a8a280ec6fe241f3b72
SHA512 2454789fefd44e179125337e7c43237f54cc328cf36f7d5ef164993d71c7f3e84f2ede97cb01d13341496e5854ac46c88806c89c15bb997926529a74c3ff533d
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPYA+wvQ8MYenGJiKEbXWtb:I6F0eMpAAYEhp/hwYLPnRWtGkN
TLSH
T141758D64E68380F1E93300F1461BE7F66B389E194031CC6BEBC4EF15BA76952767A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1A49.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1A49.tmp
Size 1.1MB
SHA256 2ee60c0115f97364aa1cec531c39f0103f5e631373dd8dcb51fa280c09015dbd
MD5 2f4eaf36ea5ef599c42bfae778a87581
SHA1 7c7a5e09d90944219e4b07a7d1d77647f407379d
SHA512 256da2a54882aeadbd840f3a4b36483d406661b2fbb5d7d527afb0cc59650cc94d1861f363570fa36f5586cc29cefc7405427e53a0dfefeb54f56d8d1aa84c29
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrYA+wWt:K6F0eMpAAYEhprhwG
TLSH
T116455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1C5F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1C5F.tmp
Size 1.1MB
SHA256 51c72fdc65a81a63f8a716654994c2fb91bf233bcdbea23d78862f83160431cf
MD5 2bae5a8f7b5155a07f8fd6ac30875152
SHA1 f9e99055a26e2d8c71bad6eebe0afb7386c2f10a
SHA512 39f41d82b74e51c07568675025b381ac77d6ebcae07b6ba27dfc43f8943ed01f103598d12c4029e7e815ed3f458b041da7b283ab6eedc6216699051ec154d4da
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORYA+wvo:e6F0eMpAAYEhp5hww
TLSH
T1E4455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 98c09947dc72db84a0a9ab15e8594493221c64fa889acf1b5ae67a8ff65459e0
MD5 0757a50a91ffb6f851c15abb7fdb4409
SHA1 6afaf460f9fff5875f0127112cda23044c25e89a
SHA512 c4e5e6b4f6cdde4bfff0b320afaff9f370120d308f9adb45bcdc9b3f57802d727a6b1dfa6b992f2cd3dbcfeb4489198fb334aba9e13551cac0ff6dc08588716d
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxYA+w/3:K6F0eMpAAYEhpZhwf
TLSH
T16C455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3152-274-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads