ccb8bf927c1e45b4e154aec8b1ed2f74fb8ff843aa5f3b456d68a33ffdc45484

General

Target
2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe
Size 164KB
Sample261017-fb4headb64
SHA256 ccb8bf927c1e45b4e154aec8b1ed2f74fb8ff843aa5f3b456d68a33ffdc45484
MD5 e210383caefae0ca330d239a25a1bcc3
SHA1 5910a8db444201aae66687e1a10d888000dcf91a
SHA512 ec7b5959726319002ae5931804af5eeb6847518428d7ff0cdc736994ef182e49be0aad7e4c19a8bbd65a469c5c953ce009cf8bcfe333908fd5c115cc28c83292
SSDEEP 768:q2H0755z8Bpl2m8IKL5I6nYpmFlglDWd18YRKWch8yXaTXMOebRpXemx34omTv7X:db/9tK2DWjKWcSQhRpnxooen/Y4hG
TLSH
T1C5F3BF03398219E5D75E4534325B73BF897A763002D665E79F62CAE91C736F2E22E203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/4680-0-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral1/memory/4680-10-0x0000000000400000-0x0000000000429000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2268	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4680-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/4680-10-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sys.tmp	rundll32.exe
File opened for modification	C:\Windows\sys.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3808	cmd.exe
4856	cmd.exe
2208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "regedit.exe /s \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4112	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3808	4680	2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe	88
PID 4680 wrote to memory of 4856	4680	2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe	89
PID 3808 wrote to memory of 2268	3808	cmd.exe	92
PID 2268 wrote to memory of 2208	2268	rundll32.exe	93
PID 2208 wrote to memory of 4112	2208	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c rundll32.exe C:\Users\Admin\AppData\Local\Temp\zt2.tmp1 St C:\Users\Admin\AppData\Local\Temp\2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\zt2.tmp1 St C:\Users\Admin\AppData\Local\Temp\2026-10-16_e210383caefae0ca330d239a25a1bcc3_coinminer_elex_wannacry.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\a.reg
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\SysWOW64\regedit.exe
        
        "regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\a.reg"
        5⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.reg

Path C:\Users\Admin\AppData\Local\Temp\a.reg
Size 152B
SHA256 3db613d24a75ae220891698c055e1c580a42e58564f568a0510db87581cc2042
MD5 b100f5324ef74ded0b998e64d07a2e19
SHA1 40b0d7f51bf2dd8451f1b723d21355c471a5fa46
SHA512 c12391bb37c334074f7d7e1257b6364fd5cbce848e0a8fe15b8326f54fd9568fe3baec58618c4334027a774a06a08ec249cb71db925c1f85feee6a3d3a816c04
TLSH
T1D9C08C9488358202D1F1AE100A8F864233F1832A3887A6102084E1C17A919C7816D2FA
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 400B
SHA256 d5cfcb92bd723643ad06ca73e7ced1b40daf1beb4faf95ba3ff3582529308897
MD5 66c9d878f82ec7ae1390e8e6868692fb
SHA1 3e22b8e9515ee13936952d69532a1ead3a216cb7
SHA512 125aabbfdc32e6bee378fd59c8a36e167fe01dcafd0c90611b5e85a5574b802a7a55ae31733db70edf822a15fc4d72e7348c0c40062cd485877c705ee66329a1
TLSH
T198E0EB015228C21FE0C0803F0970808682A438F62F1D1E7A9200DAC0254089DFC66261
MD5 SHA1 SHA512 TLSH

Submit Download

zt2.tmp

Path C:\Users\Admin\AppData\Local\Temp\zt2.tmp
Size 64KB
SHA256 1ba69934bdf0a38ca21ffacbbafd4a6223f31015cdfa4d87d8be3c97fb826f16
MD5 e7684b4705080939b3fa64754f435220
SHA1 336f8d53d5782794580880d52ffbcf218185837e
SHA512 af8d86542a6bbe9ba590f57188268f796100aa8ef11dd455438b9ede2e444e6bdf40a1d7b4f0c76e0bc5511552e0ae495c8ac5aa74f66ccea40648c43a757ebe
SSDEEP 768:P8Bpl2m8IKL5I6nYpmFlglDWd18YRKWch8yXaTXMOebRpXemx34omTv7n:k/9tK2DWjKWcSQhRpnxooen
TLSH
T19553AF02599319E9D78D8530325B777AC47A7A3011D6A5A39F62DBE81C733F2F22E207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-14-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4680-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4680-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads