Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
08/11/2026, 11:48
General
- Target 2026-11-07_84e42524e4595b0b4f6b54dde09c2f52_coinminer_elex_wannacry.exe
- Size 4.5MB
- Sample261108-nywebahh66
- SHA256 db6af8157377945e676da1f330326296c8758f8367b9c756776eca92b59a55af
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\EEIQ
-
inject_dll
%windir%\SysWOW64\ieframe.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 29 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_84e42524e4595b0b4f6b54dde09c2f52_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_84e42524e4595b0b4f6b54dde09c2f52_coinminer_elex_wannacry.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Controlle_Str.exe"C:\Users\Admin\AppData\Local\Temp\Controlle_Str.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EEIQ\Controlle_Str.exeC:\ProgramData\EEIQ\Controlle_Str.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\UlAgent.exe"C:\ProgramData\UlAgent.exe"5⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
UlAgent.exe
92FE574.tmp
AsyncTask.dll
C69747.tmp
Common.dll
Controlle_Str.exe
ProcessSession.DLL
VCRUNTIME140.dll
arkFS.dll
arkIOStub.dll
display128.log
libeay32.dll
libexpat.dll
module512.ini
msvcp140.dll
msvcp_win.dll
sqlite.dll
tinyxml.dll
ucrtbase.dll
zlib.dll
memory/3028-105-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-113-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-106-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-107-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-108-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-109-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-110-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3028-111-0x0000000003AA0000-0x0000000003B50000-memory.dmp
memory/3564-112-0x00007FF785EA0000-0x00007FF785FB6000-memory.dmp
memory/3564-104-0x00007FF785EA0000-0x00007FF785FB6000-memory.dmp
memory/3564-99-0x00007FF785EA0000-0x00007FF785FB6000-memory.dmp
memory/4220-69-0x0000000073100000-0x0000000073148000-memory.dmp
memory/4220-70-0x0000000000E60000-0x0000000000E67000-memory.dmp
memory/4220-72-0x0000000073101000-0x000000007311B000-memory.dmp
memory/4220-73-0x0000000000E80000-0x0000000000E88000-memory.dmp
memory/5964-93-0x0000000003310000-0x0000000003318000-memory.dmp
memory/5964-92-0x0000000001CD0000-0x0000000001CD7000-memory.dmp
memory/5964-91-0x00000000742F0000-0x0000000074338000-memory.dmp