turian | 1a76f7c2a817356994624c4f76c18050e8ba06a9903a3a2b051000b7eb5e9aac

General

Target
2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe
Size 38KB
Sample260821-evf1sasfld
SHA256 1a76f7c2a817356994624c4f76c18050e8ba06a9903a3a2b051000b7eb5e9aac
MD5 8de677b2c53d4ea1eaa0333a80ef590e
SHA1 fb40f60ebbdc542c155ee2d332225e78670f9a09
SHA512 5cabcf2621fe5ff62271676604ed616514af3f5d7daa2af088926eb6376a1cdea44dbf1bca30a6b49f0ea5c04ee2fef35452481b6fac2d6deb5a869e84f312f6
SSDEEP 768:uMWY3hbW1AY7CjDqqXtDYZL9OhVJ/nZkcKZcIC1Zl:uMs1JSDqQDY+J/nZS6j
TLSH
T1B4038D82E2C540F4F6CA29B031966BBB9B7A645447262BC75B73CCB54D33151F03B386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution turian persistence

Malware Config

Signatures

Family: turian
C++ Backdoor attributed to the chinese APT15.
backdoor turian

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Browser\pARamEteRs\ServiceDll = "C:\\Windows\\system32\\bssrv.dll"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
4216	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bssrv.dll	2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\bssrv.dll	2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe
File created	C:\Windows\SysWOW64\tmp.bat	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4936	2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4216	4936	2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe	90
PID 4936 wrote to memory of 5772	4936	2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe	92
PID 4216 wrote to memory of 4428	4216	rundll32.exe	93
PID 4216 wrote to memory of 5688	4216	rundll32.exe	94
PID 5688 wrote to memory of 4900	5688	net.exe	97
PID 4428 wrote to memory of 4836	4428	cmd.exe	98
PID 4428 wrote to memory of 6884	4428	cmd.exe	99
PID 4428 wrote to memory of 4668	4428	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_8de677b2c53d4ea1eaa0333a80ef590e_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 C:\Windows\system32\bssrv.dll,install
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\tmp.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\SysWOW64\reg.exe
      ReG aDd hKEy_LOcAl_MaChiNE\SYsTEm\CuRRenTCoNTRolSeT\SeRViCeS\Browser\pARamEteRs /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\system32\bssrv.dll" /f
      4⤵
      Server Software Component: Terminal Services DLL
      System Location Discovery: System Language Discovery
      PID:4836
  - - C:\Windows\SysWOW64\reg.exe
      ReG aDd hKEy_LOcAl_MaChiNE\SYsTEm\CuRRenTCoNTRolSeT\SeRViCeS\Browser /v Start /t REG_DWORD /d 2 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:6884
  - - C:\Windows\SysWOW64\reg.exe
      ReG dELete hKEy_LOcAl_MaChiNE\SYsTEm\CuRRenTCoNTRolSeT\SeRViCeS\Browser\pARamEteRs /v ServiceDllUnloadOnStop /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
- - C:\Windows\SysWOW64\net.exe
    net start Browser
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start Browser
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE" > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bssrv.dll

Path C:\Windows\SysWOW64\bssrv.dll
Size 33KB
SHA256 378417a4a78bc28cf237d0f53043fa821fc056fee4954fcad868fe443fad1ff1
MD5 fc4217393b81a1ef52f9554d3121135f
SHA1 1276d1873b9802b2daeda07f84029af5c1ec0639
SHA512 212b880eac60d15ea338d986e1dac90f55add817e06c364954f324232e94c5989d19ed641852be2d86ebf02256d2800b1584779d0bb65efbffe67060d2645a79
SSDEEP 768:y1AY7CjDqqXtDYZL9OhVJ/nZkcKZcIBR1Zl:y1JSDqQDY+J/nZStj
TLSH
T1CEE28D81E2C680F8FA8729B031967BB79679A45447262BC75B73CCB64D33151F13B386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.bat

Path C:\Windows\SysWOW64\tmp.bat
Size 371B
SHA256 0409b9e59486f3bc9b4484195242ac65fc44583d4342fa8767bdb987089be23d
MD5 b87ab2fe75c7740fdabbcd7515242474
SHA1 0eaf60383c6ab80744ddaadfa699e69432cb30ea
SHA512 4473a1c268bcfadb1900a019559e06aca96bd09a572f12b86a20a6389cfe751376b92552bf1518801bd7938a985a7b3d830ff94e8c238b73a1c963e9f09585a4
TLSH
T1D7E0D800DB8212DCD3C55638CD45521A31D4E4AD418EACC13CFF8448E68B82A0A73EFE
MD5 SHA1 SHA512 TLSH