Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe
- Size 256KB
- Sample260825-d2fg6asvcw
- SHA256 26371a7d0a81b5d849bd19bcbb3faf4db18f837e7edf63533d4818f359b6a8a9
- MD5 b48bc7f497771c81dae14a57abcba99d
- SHA1 5722194475c62a49ceac858db94d3d500c20982c
- SHA512 6e13e74e49f1717aa863160146eb20c6fb77f989d7e74c9384b2ba96622a19f1e05ff60acee6654384b141c1bf7e6d094a60420863e7d4edee1e25ca2c44fdd1
- SSDEEP 6144:yT5rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRws:yTL9Vx6ISvO2x9mONvKRws
- TLSH T1BD44BF2362C1C076D463147895299BBD9BA9AD721361A4C3F760FF256F307E2E23874B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1468 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\c1471773\jusched.exe 2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe File created C:\Program Files (x86)\c1471773\c1471773 2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe 1468 jusched.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1468 1208 2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_b48bc7f497771c81dae14a57abcba99d_amadey_elex_lolbot_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\c1471773\jusched.exe"C:\Program Files (x86)\c1471773\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1468
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\c1471773\c1471773
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\c1471773\jusched.exe
- Size 256KB
- SHA256 0b357a86029572d1a8285e3fe2c4e4c474b918f5b9c9d62bffbdf7bec5531355
- MD5 d1660215f964d497df821f874c482bdd
- SHA1 e5f52303965ed5372cca9ab4c6b1d63b8b288be1
- SHA512 7fc13fbe1d6cfc9633d41b82a4d35d7b9e893042d7e0778c2c9192f40b190e8ad9755f78eafbc4205e122fe8d08069e482f4528de64e17de6829a2ede853efd9
- SSDEEP 6144:y85rA29Vx18IcTgav1cdCTuoPbgwmOLJvKRw7:y8L9Vx6ISvO2x9mONvKRw7
- TLSH T11D44BF2362C1C076D463147895299BBD9BA9AD721361A4C3F760FF256F307E2E23874B
- MD5 SHA1 SHA512 SSDEEP TLSH