e87549e9e92bd3a7d42f361ebaa356d21a35aa7788c34a096f59294ff97f8fab

General

Target
2026-09-10_70762d051fea835dddc6a56caed42817_elex_wannacry.exe
Size 1.2MB
Sample260910-sxpmla1hkb
SHA256 e87549e9e92bd3a7d42f361ebaa356d21a35aa7788c34a096f59294ff97f8fab
MD5 70762d051fea835dddc6a56caed42817
SHA1 fa427353579dfd798df45dd4164f8648ba4626d0
SHA512 c0de7210cb05988d85c62614bc4b53e11e850098a7bd52b3eec8de1a320205125d38d7e79812e35f15613f6fb1670fdda1a92fbcd68831ce3936a96055907da3
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnYA+wIn:K6F0eMpAAYEhpbhwq
TLSH
T15A455B55E683C4F5ED2314F0450BEBFBA5309E2A4031CD6BEBC8FE01BAB2D523529656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_70762d051fea835dddc6a56caed42817_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	original_temp.exe
2872	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2872	4828	2026-09-10_70762d051fea835dddc6a56caed42817_elex_wannacry.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-10_70762d051fea835dddc6a56caed42817_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_70762d051fea835dddc6a56caed42817_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX8873.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX8873.tmp
Size 1.1MB
SHA256 91f3c8cc0d133662fb9dd9dde4316fe39fae4908b9b673123d6f33e83959d396
MD5 2ed16ddfb0c5801adfb9b8b64e3fc75c
SHA1 4af7f68eb218a538e834d4a366565126d70dfc32
SHA512 35512371e8c0d58732bc04dad1e83e06e16799fe14c1f4e565a169839d932706883fa18561109f4667ac6a91a74035d15efcac671a569adfbdc2c49266d1be65
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOWYA+wx:s6F0eMpAAYEhp0hw
TLSH
T19E455C54E683C4F5ED2314F0454BEBFBA5309E2A4031CD6BEBC8FE01BAB2D523529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 ed37f0fd31872d3e40aa0ef5967b1e625aa9e24454d81c26ad8af68ea222b33b
MD5 9d640a11479a3bbfaa7017e35198371a
SHA1 f53c25bc6c79466b0b7d797ebd164509499100d4
SHA512 0d89b7067b2a71d47f2dec1b760449142d2ebbb40f40c2086a007091c741ec332765579fa5a4565c0987c09dceac7a76b696adfd689df28e174fb35b7cb9858a
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnYA+wI:K6F0eMpAAYEhpbhw
TLSH
T159455B54E683C4F5ED2314F0454BEBFBA5309E2A4031CD6BEBC8FE01BAB2D523529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 3860a2dfbac34feafc071e2f0ef9d482abf31d0bdf4f9c3ba4efe1439a2512a7
MD5 3aade55bc03259618d096248b89624bc
SHA1 86c5217a164aeb556c297e6ffa83122eb9ab53f7
SHA512 5721f9f90c4c4d0348ff6d85a4c4fb3c30d51d2c39f1d4e8942014abaddd56dbd9051966acdccc8d2fad96fc16e1703ebc27e59bf1acec2f9d4e8204e535b2d8
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTYA+wM:O6F0eMpAAYEhprhw
TLSH
T19B455B55E683C4F5ED2314F0450BEBFBA5309E2A4031CD6BEBC8FE01BAB2D523529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 69be410f30980a07411df72060c8d492e86c5966d3b430c6111d23d73880a6c5
MD5 f2d190b20a43742b654997b0ca3ddb7f
SHA1 efcfb9c0afd265feb32322ea8c167b2d8771238a
SHA512 01fda4bda58e45cd33d845d74757fd948f222402e2fbf56484514914476ede8fb9447cd0504012ab5396989bc5c14244a7d479b85d5193077a6cd3b51b21169a
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuYA+w2:W6F0eMpAAYEhpUhw
TLSH
T17F455B54E683C4F5ED2314F0454BEBFBA5309E2A4031CD6BEBC8FE01BAB2D523529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 25ea726cd604d15eb79d816ac085f871943f8975060a7ba352973c1815032e53
MD5 90eb15984aead902ae54ba8dd3aa5f98
SHA1 89e685b5aa72e90482669569110a22f6a54c0b1d
SHA512 307ed3d5f0de4c24f640cba2b4c0ce928ba87c7edec0321d5f0f84addb2417cb51a432e3f13c4765f5068c8c281af7d525593af3faba0ab77a3adf97d63dfceb
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO2YA+wx:K6F0eMpAAYEhpAhw
TLSH
T16A455B55E683C4F5ED2314F0450BEBFBA5309E2A4031CD6BEBC8FE01BAB2D523529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4828-152-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads