250da6f61856ec0391000cd840170ce64b42f37889e9071c1efde5acb230312d

General

Target
2026-08-16_d7eccdfcd3b4a842cd0dfece6ea6f698_elex_wannacry.exe
Size 1.2MB
Sample260816-d5rdtsyfjc
SHA256 250da6f61856ec0391000cd840170ce64b42f37889e9071c1efde5acb230312d
MD5 d7eccdfcd3b4a842cd0dfece6ea6f698
SHA1 bafa23f19497e53796bc7714b33cda020d059a77
SHA512 ca2f89e5dd5cf784ec23aa9488f4e94540aaad920d75c97eaf897c736eb7660bc247b2301a089ac91ae5b853cd6d57ab210db5ccf78b7a04f651e648ff8a9b34
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQIYA+wYbk:Y6F0eMpAAYEhpxhwGk
TLSH
T15C456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
260	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_d7eccdfcd3b4a842cd0dfece6ea6f698_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
260	original_temp.exe
260	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 260	932	2026-08-16_d7eccdfcd3b4a842cd0dfece6ea6f698_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-16_d7eccdfcd3b4a842cd0dfece6ea6f698_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_d7eccdfcd3b4a842cd0dfece6ea6f698_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX1A48.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1A48.tmp
Size 1.2MB
SHA256 90ee97f3859b6418f2de999f4b992bec69396265756597528760dc8e770948ca
MD5 9cfff64e7429dba2ea86c506c6408274
SHA1 1b9de7dcee102f29866eff355828514a7057ffe9
SHA512 f7f5fa6b48874b4667c06357662f151e2b1ae5336bd919a79c8e7499647d4f710f1b4beed056c7cd8a4cd5b553c04a55a4bb91615b3b40f29276f921f9ea28c0
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEIYA+w9z:n6F0eMpAAYEhpNhwt
TLSH
T128456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 80b6c6804f8f015c90e71e633d40ac640732d55f6f85bd612afdddcf7509ee40
MD5 3c4f63429c7fd709a5b20b31085a6eab
SHA1 5b089083263709f0eef46411815cbdcb1ffec091
SHA512 b5fcff56ce91e6a5fce7eac2a6950374a20a0b4e1da1c2997885acb3e857e5f5cc1f13ad21b5357009af8a96356c50cada825268a61b3f1298f7bd0a7647e1e8
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQIYA+wYb:Y6F0eMpAAYEhpxhwG
TLSH
T1E0456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 f1682c83af492d3011efcf304c65f7f97b3444abe311cf060b18bfc8a88ba014
MD5 b31dd8af7457053b4842ab814245893b
SHA1 655a67c8b943ac3651ab8e5cf417e335a0e99dd9
SHA512 18053ffba212a0a23c6f58094f80663c5098adb37a1a72c5e52601e25f56769ab1ff7a4260aae0c2f9c9b38714a34cfa535bbfc6104d700db5a156919d57707d
SSDEEP 24576:37VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMIYA+wEB:c6F0eMpAAYEhpVhwI
TLSH
T1C3456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7f8050a9ce704542303017946161563793eb62eac92148566dabc33e6e431253
MD5 e000d9179313176281d49f69ba6c8550
SHA1 98c46c84efc3238670f8229d1ef6286e83460b82
SHA512 f7486a4c0838b373f19114ca90d2a93e1f78b8778698380c5fe6399c3df412d88cda0255fa30f57c198f72a56b5ba343725f6ebc035a078e13840c06690bfba3
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeIYA+wK3:I6F0eMpAAYEhp7hwY
TLSH
T1E7456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-156-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads