Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 04:00
General
- Target 2026-08-22_7cdd492f8bf92e342c2671c79baf274d_elex_wannacry.exe
- Size 10.0MB
- Sample260822-ek5w6aeb39
- SHA256 3924cc20aef6c2864187f4d5f942056b1f2ac33ab66af6e0ce0985701a3ea091
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\HelperMaintain_dev
-
inject_dll
%windir%\SysWOW64\input.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 30 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_7cdd492f8bf92e342c2671c79baf274d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_7cdd492f8bf92e342c2671c79baf274d_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Builder-Turbo.exe"C:\Users\Admin\AppData\Local\Temp\Builder-Turbo.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\HelperMaintain_dev\Builder-Turbo.exeC:\ProgramData\HelperMaintain_dev\Builder-Turbo.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HelperMaintain_dev\DOJZTXLAIUKCGN\Builder-Turbo.exeC:\Users\Admin\AppData\Roaming\HelperMaintain_dev\DOJZTXLAIUKCGN\Builder-Turbo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\OrbitDoc.exeC:\ProgramData\OrbitDoc.exe5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\ChannelAgent\memu.exeC:\Users\Admin\AppData\Roaming\ChannelAgent\memu.exe5⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\NexusCo.exeC:\Users\Admin\NexusCo.exe4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\HelperMaintain_dev\memu.exeC:\Users\Admin\AppData\Roaming\HelperMaintain_dev\memu.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
OrbitDoc.exe
26EBEB2.tmp
4BDD6DE.tmp
4BDD6DE.tmp
700EE9E.tmp
842FBCD.tmp
ACE.dll
Builder-Turbo.exe
Common.dll
GmsCommon.dll
StatusEventHandler.dll
WsmanClient.dll
msvcp100.dll
msvcp_win.dll
msvcr100.dll
pipelineparam16.db
servicemgr50.ini
ucrtbase.dll
pipelineparam16.db
memu.exe
NexusCo.exe
memory/1516-96-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-66-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-89-0x00000000751A0000-0x00000000751A1000-memory.dmp
memory/1516-83-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-63-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-64-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp
memory/1516-65-0x00000000751A0000-0x00000000751A1000-memory.dmp
memory/1516-125-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-98-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-68-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/1516-75-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/2540-171-0x00007FF7B1B10000-0x00007FF7B1D73000-memory.dmp
memory/2540-170-0x00007FF7B1B10000-0x00007FF7B1D73000-memory.dmp
memory/2540-155-0x00007FF7B1B10000-0x00007FF7B1D73000-memory.dmp
memory/2872-167-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp
memory/3372-137-0x0000000001230000-0x00000000015BA000-memory.dmp
memory/3372-135-0x0000000001230000-0x00000000015BA000-memory.dmp
memory/3372-144-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp
memory/3372-175-0x0000000001230000-0x00000000015BA000-memory.dmp
memory/3372-152-0x0000000001230000-0x00000000015BA000-memory.dmp
memory/4844-51-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp
memory/4844-50-0x00000000739B0000-0x0000000073A02000-memory.dmp
memory/5684-172-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/5684-162-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp
memory/5776-133-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/5776-145-0x0000000000520000-0x0000000000586000-memory.dmp
memory/5776-123-0x0000000075180000-0x00000000751D2000-memory.dmp
memory/5776-121-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp
memory/5776-120-0x0000000075180000-0x00000000751D2000-memory.dmp