6323bc64e371d8b3f560f6c82f4281c8c83c3af2da58eec539a19682f3a8c763

General

Target
2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe
Size 134KB
Sample261110-hfa3rsde62
SHA256 6323bc64e371d8b3f560f6c82f4281c8c83c3af2da58eec539a19682f3a8c763
MD5 8779cbe250f5dd19736b3e3bfe30352c
SHA1 ef13f99c83dea0e0cf25f119eebab9d370076e38
SHA512 bc0bcb580c448e969403199c461961cd8dcfc7bf47d5ade6be19248f1110c7c6f94c53fa2cfa9e4540878e10f1b9d5e3822a24e477d392ef363fb104fe1aa104
SSDEEP 1536:t3aaczXhtqkUla/NGVcJ/gAqcX0JMseuiGSeNVvDi0tMuUJJny3GM+9NO5f:Qauqc9rqzMseNoVv9EJFnM8Ny
TLSH
T17BD3270273E6C154F1B21B30CA7646F04AABBCAAE971925F17407E5E7E32A50ED21727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2860-0-0x0000000000400000-0x0000000000423000-memory.dmp	UPX
behavioral2/memory/2860-2-0x0000000000400000-0x0000000000423000-memory.dmp	UPX
behavioral2/files/0x000600000001b85a-3.dat	UPX
behavioral2/memory/1716-5-0x0000000000400000-0x0000000000423000-memory.dmp	UPX

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1716	dgzrb.exe

Executes dropped EXE 1 IoCs

pid	Process
1716	dgzrb.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2860-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2860-2-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x000600000001b85a-3.dat	upx
behavioral2/memory/1716-5-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3296	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	1716	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dgzrb.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3296	cmd.exe
2040	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2040	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe
1716	dgzrb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3296	2860	2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe	89
PID 3296 wrote to memory of 2040	3296	cmd.exe	91
PID 3296 wrote to memory of 1716	3296	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&c:\dgzrb.exe "C:\Users\Admin\AppData\Local\Temp\2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2040
- - \??\c:\dgzrb.exe
    c:\dgzrb.exe "C:\Users\Admin\AppData\Local\Temp\2026-11-10_8779cbe250f5dd19736b3e3bfe30352c_coinminer_elex_strictor_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 424
      4⤵
      Program crash
      PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1716 -ip 1716
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dgzrb.exe

Path \??\c:\dgzrb.exe
Size 134KB
SHA256 0f2c3b81133c33a877c6b6860b8e28629de61eee84f7032ab8ebd956708403ec
MD5 f0c95bc0fed43fc37a5b5685060f5ef9
SHA1 bc8b5c599a28625e9177effc3de65de3915101ba
SHA512 d3ec661a94ef7f218e8ab00b027eb4b661d27bc6f0b87c81e426c6df0b570e9b82e9d08084e8fd8d8de496aea2ab686aef1e5f4c08e3323fe1558a33b418001b
SSDEEP 1536:t3aaczXhtqkUla/NGVcJ/gAqcX0JMseuiGSeNVvDi0tMuUJJny3GM+9NO5S:Qauqc9rqzMseNoVv9EJFnM8Nz
TLSH
T129D3270273E6C154F1B21B30CA7646F04AABBCAAE971925F17407E5E7E32A50ED21737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-5-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2860-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2860-2-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads