02c6f140eb8f6528f01ef78e9d49943ed76649857bdad1ff2dde7c3d6530896b

Analysis

max time kernel
12s
max time network
2s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe
Size 95KB
Sample261002-3dtgjsverb
SHA256 02c6f140eb8f6528f01ef78e9d49943ed76649857bdad1ff2dde7c3d6530896b
MD5 e9f94d359ede3c8a3ba26d2874eb2c89
SHA1 f9f1b71104ce43ea389e55b4256e35dc3b8f78cf
SHA512 0fa31a2f6995531ca91b64b0de3e21f0f7d790c26ea95362ccee4c79fe57c656b14c350b133b160cd511c856b71e571cb8e84e18fda684c4a8bd75424d90874e
SSDEEP 1536:2FbeITsAro5ZNjzFmAa6IBA2oESRF6gQ+bfSgTrnaMGtlUtilt81t2omCEi15:2FawsA+HjzFmRa2MF9btHaUtilt81soz
TLSH
T11593D003BAD3C0B6E46606B018BA9E829777BF111BA7C90767F4374F2D31684D926397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b9-7.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4884-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2904-15-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3896-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4544-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1672-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bb-26.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3896-28-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
2904	MSWDM.EXE
3896	MSWDM.EXE
2560	2026-10-02_E9F94D359EDE3C8A3BA26D2874EB2C89_AMADEY_ELEX_RHADAMANTHYS_SMOKE-LOADER_STOP_WANNACRY.EXE
4544	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe
File opened for modification	C:\Windows\dev71DB.tmp	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_E9F94D359EDE3C8A3BA26D2874EB2C89_AMADEY_ELEX_RHADAMANTHYS_SMOKE-LOADER_STOP_WANNACRY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3896	MSWDM.EXE
3896	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2904	4884	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe	89
PID 4884 wrote to memory of 3896	4884	2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe	90
PID 3896 wrote to memory of 2560	3896	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2904
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev71DB.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-02_e9f94d359ede3c8a3ba26d2874eb2c89_amadey_elex_rhadamanthys_smoke-loader_stop_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\2026-10-02_E9F94D359EDE3C8A3BA26D2874EB2C89_AMADEY_ELEX_RHADAMANTHYS_SMOKE-LOADER_STOP_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev71DB.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-02_E9F94D359EDE3C8A3BA26D2874EB2C89_AMADEY_ELEX_RHADAMANTHYS_SMOKE-LOADER_STOP_WANNACRY.EXE!
    3⤵
    PID:1672

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-02_E9F94D359EDE3C8A3BA26D2874EB2C89_AMADEY_ELEX_RHADAMANTHYS_SMOKE-LOADER_STOP_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_E9F94D359EDE3C8A3BA26D2874EB2C89_AMADEY_ELEX_RHADAMANTHYS_SMOKE-LOADER_STOP_WANNACRY.EXE
Size 95KB
SHA256 faee7aa650cdb3276ad9cca544597833948253c3443ba45999671c90ea704419
MD5 67eaa188b8245cbe62a9357b58479c29
SHA1 0da8f9d3660e97bc180d2a30f823392182b38f95
SHA512 1baa4dce66b05c298dfc80909b3c29b0ea7ca3931b3fd1105dc93af5d779af01e02acace76f07bbadce6540f654635af0180e766b03822b6d2c38e7848151317
SSDEEP 1536:2FbeITsAro5ZNjzFmAa6IBA2oESRF6gQ+bfSgTrnaMGtlUtilt81t2omCEi1Q:2FawsA+HjzFmRa2MF9btHaUtilt81som
TLSH
T19C93D003BAD3C0B6E46606B018BA9E829777BF111BA7C90767F4374F2D31684D926397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 93e818c69e54045002ed0d01ecc662541ec7f2b21297026e1fe831d12339e849
MD5 d5590277f5e48fd322026b29f4ef697b
SHA1 d71d5051656167a02d093e2405e7a5f7eaf52961
SHA512 cc7e84a1946c3764e433ffd77aa2bd23ae364f09c4452e6c17646f57724c0ae178005afa3b9ccbc83c0a1e27865a21b11f48eda730f338201cf0211e12b13d4f
SSDEEP 1536:2FbeITsAro5ZNjzFmAa6IBA2oESRF6gQ+bfSgTrnaMGtlUtilt81tU:2FawsA+HjzFmRa2MF9btHaUtilt81e
TLSH
T1D583D01375C3C07AD41A41B408AE9F81A7776F166BA7C01773E9134F6D326D88E3A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev71DB.tmp

Path C:\Windows\dev71DB.tmp
Size 15KB
SHA256 24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088
MD5 b0cec9f342bf95700b602ee376446577
SHA1 b955b1b64280bb0ea873538029cf5ea44081501b
SHA512 05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e
SSDEEP 192:WN8CeeT+a2j12sUr/XKRbU+86HOO7+Bb2NpWP1oynJ+y7ihXar28d/o:xeT+a2jfUrfKRa6HiqpA13+y7+Xa1
TLSH
T15A62F7029FA804A1FBFB0B307EFA5D539576BD200964EF0E46707BAA5D70600E952767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2904-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3896-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3896-28-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4544-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4884-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4884-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download