Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 06:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 454KB
- Sample260819-hdc5cazzf1
- SHA256 19826752598bc1dd74afea22b20ce7fe78fc9e1c007e2485318c776809bb07c4
- MD5 077d37ebb6dd1c471d43c2b2a43b39d7
- SHA1 b182277e1cb8d515734e9ded5735f644cbdbe59a
- SHA512 3842298a6030a1fa03d347c9fcece2ec4d931a7eb29bf4e7efc8aac7d47d6155fcc24c8308ff988c956dc20ff1e44f95fdbd4bdab4406ac6702a3e3ceee1bc8a
- SSDEEP 6144:yg5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/sB:ygL9Vx6ISvO2x9mONvKRwLSFQry/sB
- TLSH T16EA48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2424 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\48d54c9c\jusched.exe 2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\48d54c9c\48d54c9c 2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe 2424 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5552 wrote to memory of 2424 5552 2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_077d37ebb6dd1c471d43c2b2a43b39d7_amadey_coinminer_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Program Files (x86)\48d54c9c\jusched.exe"C:\Program Files (x86)\48d54c9c\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\48d54c9c\48d54c9c
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\48d54c9c\jusched.exe
- Size 454KB
- SHA256 aae61310e0c600f6b79f7f44a46841148da98ee689fffa0e9c2f2f66952f34c9
- MD5 466e77b6066bc9c625ae1f67b8102ce3
- SHA1 ecba0fc9fe5ff0c49bea8d82205f50d5452c8a9b
- SHA512 f9d9c4c8dc5e4a1f5e46c6ac5a10f1b8f4bbd5063363ab6a09f025b48b9b48a6900c6ed329e3c12b5c52c94c2aa1a5401c6aa98da6635c68213e192e35ec95a5
- SSDEEP 6144:y35rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFkry/sO:y3L9Vx6ISvO2x9mONvKRwLSFQry/sO
- TLSH T144A48E36AAD0C036D473457584A587BABEA5BD323311588FF391F71A1E227E3BA6070D
- MD5 SHA1 SHA512 SSDEEP TLSH