e1322571ad926f466774917716c3d31a30777d40f7edde1a185cd0253fb076a3

General

Target
2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe
Size 1.7MB
Sample260905-pr7pfa1yet
SHA256 e1322571ad926f466774917716c3d31a30777d40f7edde1a185cd0253fb076a3
MD5 445062425f1b866fa542357b62424ad5
SHA1 167a16a6a5ad014b4e59ea75da5d06cae1871398
SHA512 12fb17222ad19eec248c5c940f0abbc51a46159fbad0167965f6237357e5a21496c69048595aee58221f2c8db5be8fdd426d09aef416dc79da184c131293c71c
SSDEEP 24576:k53uhFjYRb/tvtqICg0F6pt0hy9/VgEdpu5juNAR8FiFHirEbK8UCPacch/aR3lv:k5+hFjC7KBFmiY9VujBK7x9kK/affoSb
TLSH
T18A852321B7A741B5C9E32630A510B76A12BFED110F291AD75E603A135D338E7EE7C6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000002448c-36.dat	UPX
behavioral1/memory/4700-40-0x0000000000400000-0x0000000000434000-memory.dmp	UPX
behavioral1/memory/4700-46-0x0000000000400000-0x0000000000434000-memory.dmp	UPX

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3860	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	DH1326.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4700	DH1326.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002448c-36.dat	upx
behavioral1/memory/4700-40-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/memory/4700-46-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3040	cmd.exe
1056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DH1326.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4676	2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3040	4676	2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe	86
PID 4676 wrote to memory of 4700	4676	2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe	88
PID 4700 wrote to memory of 1056	4700	DH1326.exe	89
PID 1056 wrote to memory of 3860	1056	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DLHK26\KillDuplicate.cmd" "C:\Users\Admin\AppData\Roaming\DLHK26" "2026-09-04_445062425f1b866fa542357b62424ad5_coinminer_driverpack_elex_wannacry.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3040
- C:\Users\Admin\AppData\Roaming\DLHK26\DH1326.exe
  "C:\Users\Admin\AppData\Roaming\DLHK26\DH1326.exe" /silent
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\47E1.tmp\47E2.bat C:\Users\Admin\AppData\Roaming\DLHK26\DH1326.exe /silent"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47E2.bat

Path C:\Users\Admin\AppData\Local\Temp\47E1.tmp\47E2.bat
Size 33KB
SHA256 ce8681302b2a5fc897c63bec210e3e3787596ff933fbb5e358f7fd59a9e657e0
MD5 6f129092cb7254fe910b4afd50e8e729
SHA1 cf3dd910d73499a95e145473f465c1c9f13ac7e9
SHA512 0c99ba98a85e597aa6518cca4545f52515fc5e580cd38d46ec04aa388cca3e369bbf3ba46ae0b10a095cba180f24ebe2355e6108a1e1ae2040930ecb94b3df45
SSDEEP 384:6hzgo1X45A81hf5PHMB9LMJZLoBz/Sh0GvbY9lnMZhN1i4:cDOA81d5PsUiz/S6GvKAN1i4
TLSH
T15CF246544835C8D0AF83B73173066D450DB9EA0D3B1918866BAAE01FF598F7AD3FE1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DH1326.exe

Path C:\Users\Admin\AppData\Roaming\DLHK26\DH1326.exe
Size 75KB
SHA256 ea4d3b320835a67355da00e5655895d0e9f7f9d2350003e8c9d6246a2a0db607
MD5 b798800ddc8fd4e9938a93f18b5a0f9f
SHA1 4a6d45eb7c2882f85947420cac59a527e0bbd243
SHA512 f9c639ba5c2271bc87bbc66c9f214d9cf7fa44bedc639e5688de810a554e9cb934aebe23787b939b196824da2ab3ebc52ffabc85bb8ca7cbac943173c75965bb
SSDEEP 768:JlJaG0qks7T4lRjq4odluw3tAM2ajVnbcuyD7UjL/LVUHMG3FOKh3N0:J/NlxT4fq4odluwF2Onouy8jXVXK
TLSH
T1E1737DC791080BFACA633479487EAAD060AD8FB8591484D29EB53C37CB77ADBD435507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4700-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4700-42-0x0000000000433000-0x0000000000434000-memory.dmp

Download

memory/4700-46-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads