d1908a85d61ff1c19f454a562ff370fb66e0fc6f35b16eb537cc59e5f68f0d3b

General

Target
2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
Size 98.0MB
Sample260817-qjdl3asscw
SHA256 d1908a85d61ff1c19f454a562ff370fb66e0fc6f35b16eb537cc59e5f68f0d3b
MD5 5c3e7c14cb6f8d82d7b8de7a025f0826
SHA1 0c76cecfb71a69b08c6edbf579e2516409c36959
SHA512 5ad0da4a61031762652e926a3acab78cd53eaea44fb00d3f319beb491e90ed77d3e2c68fb36453606d10a809671c221d947058dd139df70782b81c68588349a0
SSDEEP 3145728:i33333333cr33333333cr33333333cr33333333cr33333333cm:i33333333cr33333333cr33333333cr+
TLSH
T17338E14AFC4650B0DD3E64700CDBE23B4836BE3AC4258A9AF9CA7B067B37E61541F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1768	svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
3112	svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBBCCCAAAABACABBCCCCBBBBCCCBBBACBCCBACAAABBCBABBBBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe"	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4940	sc.exe
4856	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4632	cmd.exe
3956	cmd.exe
2400	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
1768	svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
1768	svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
Token: SeDebugPrivilege	1768	svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4632	1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe	90
PID 4632 wrote to memory of 2332	4632	cmd.exe	92
PID 1436 wrote to memory of 3956	1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe	93
PID 3956 wrote to memory of 4940	3956	cmd.exe	95
PID 1436 wrote to memory of 2400	1436	2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe	96
PID 2400 wrote to memory of 4856	2400	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_5c3e7c14cb6f8d82d7b8de7a025f0826_amadey_coinminer_elex_hijackloader_luca-stealer_njrat_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABAACABAAABCABBBBBBCCBABABAABBCACCABCCBCBBABBCCBBCBBBCCCAAACCABCBACCBBACCBAAABACAABCCABACCCBCBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABAACABAAABCABBBBBBCCBABABAABBCACCABCCBCBBABBCCBBCBBBCCCAAACCABCBACCBBACCBAAABACAABCCABACCCBCBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCCBABAACCBBBBCCBACCBABCBCBBBCAAACBBCBBBBCCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe" start= auto displayName= "UserDataSvc_BBACCCBABAACCBBBBCCBACCBABCBCBBBCAAACBBCBBBBCCCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCCBABAACCBBBBCCBACCBABCBCBBBCAAACBBCBBBBCCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe" start= auto displayName= "UserDataSvc_BBACCCBABAACCBBBBCCBACCBABCBCBBBCAAACBBCBBBBCCCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCCBABAACCBBBBCCBACCBABCBCBBBCAAACBBCBBBBCCCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCCBABAACCBBBBCCBACCBABCBCBBBCAAACBBCBBBBCCCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCBAABABACBACBACABCBBBCCBAACBCCCCBCBCACBCAAAACBACAB.exe
1⤵
- Executes dropped EXE
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d5d6d98b30f29b5488f050f32dcd31eeaa0ed902c2afeec83a56e3b7d53cddb
MD5 b2ae6de1e2a7d6e771af434630b0620b
SHA1 8375b6a4d642e9d4733ca8841f7c0bc3f5515f5d
SHA512 0f55af97e129f9fc080babe2c1f3c13c99ed049a34da6af2a78bbaaee76cf4f08dfe7c06cc7fecf9ba3fe4c82c41b48ac798e5474984858b87b1bc4522fa20d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 08cf2fb6c0c347380b1fb3675a83a01b4f65bb1cb16904afa0324f568e5e4ebd
MD5 b45a210275edfe714a5506ef10c808be
SHA1 94e7655fc6c41f1bd376d1443280b9fe43eaab1b
SHA512 b0d983c4bf42661e94714e982b8b84e836829aa0d509bfe980a796a8d569e184bf6f93564788537b004385017e29bc3123892a2a559dfcf2459e476d4f1301aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be712830048af59d36bd0f88e0db32e7313f40a35ce09e4eda5ac6796049dc85
MD5 3c3dc030075e58c59aa125efcdee7e34
SHA1 3373db3ff4801864074354d105152bca317e1ea4
SHA512 38e4087b6c0ca810e1e27d7036f0cd3138aa67db5f1b42fc01e4ef159811b6ad7d2ee0ddf5bdeb13ec67e0e02cc8ec384d428ef1ca3fa7938b23c330f0bb90e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3613b965cafd8c6fbca02351f1b283f8d741249cb8ff591a310717105618d30f
MD5 f4e8b396dfff1a2bc95725bcb96db6a5
SHA1 cba7536185cc6011bad8673e38ee3073b97fab4d
SHA512 5841d514974d3f828c340f9aa62770f021d7d5267a505a1f1f7a61c47441bb857172acb842abc32803ac10a39aa60651b327da07ff6fcdc31d5f1fc383e35f8b
MD5 SHA1 SHA512

Submit Download

memory/1436-0-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/1436-8-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/1768-24-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/1768-38-0x0000000000500000-0x0000000000521000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads