Hostile ^93% Download

2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry

Multi-malware dropper with injection

Unsigned Microsoft-branded PE with custom RWX loader sectionUnsigned Microsoft-identified PE performs remote-thread injection

SHA-256ed2438be14e02a5c73b78977515673f0721cef9b30db76d8ecd0465a8a617060

URLhttps://tria.ge/api/v0/samples/260930-p259cszala/sample

MaleculeK(Mc)O₁₀(CoEr₁₁As₉La₂P₂C₂Dy₃I₂Pr₃Xe)H₉(Hf₆Cm₆Db₃F₁₂Mg₂Os₂₂Po₁₆TiU₅)Md₅(Bi₁₈HePaSi)Th₂

Evidence

Windows path join format string 0x600–0x800

⋯3 more rows
0x63056657273696f6e5c537663686f737400Version\Svchost.
0x6406e65747376637300534f465457415245netsvcs.SOFTWARE
0x6505c4d6963726f736f66745c57696e646f\Microsoft\Windo
0x6607773204e545c43757272656e74566572ws NT\CurrentVer
0x67073696f6e5c537663686f737400000000sion\Svchost....
0x6802553797374656d526f6f74255c537973%SystemRoot%\Sys
0x69074656d33325c737663686f73742e6578tem32\svchost.ex
0x6a065202d6b206e65747376637300000000e -k netsvcs....
0x6b0d7a2b2e1b1edd0b4c8ebb3c9b9a6a1a3................
0x6c000000000ccedbcd3b7fecef1d5fdb3a3................
0x6d0d0b4c8eb000000005365727669636544........ServiceD
0x6e06c6c0000257325735c257300484b4559ll..%s%s\%s.HKEY
0x6f05f4c4f43414c5f4d414348494e455c00_LOCAL_MACHINE\.
0x700506172616d6574657273000044657363Parameters..Desc
0x71072697074696f6e00446973706c61794eription.DisplayN
0x720616d6500547970650000000053595354ame.Type....SYST
0x730454d5c43757272656e74436f6e74726fEM\CurrentContro
0x7406c5365745c53657276696365735c2573lSet\Services\%s
0x75000000000646c6ccec4bcfeb4e6d4da2c....dll........,
⋯11 more rows

WriteProcessMemory API reference 0xec9–0x11b9

⋯3 more rows
0xef9b7a2c9faa1a30025735c25645f726573.......%s\%d_res
0xf092e746d70000000b5bd52656c65617365.tmp.....Release
0xf195265736f75726365000000ccedbcd3b7Resource........
⋯7 more rows
0xf99bd4143746976655820b0b2d7b000005a.ACtiveX ......Z
0xfa96875446f6e670064656c005359535445huDong.del.SYSTE
0xfb94d5c43757272656e74436f6e74726f6cM\CurrentControl
0xfc95365745c53657276696365735c25735cSet\Services\%s\
0xfd9506172616d657465727300496e737461Parameters.Insta
0xfe96c6c4d6f64756c65000000b0b2d7b0cellModule........
0xff9c4bcfec3fba3ba00000000706172616d...........param
0x1009657400000000005c1c4000000000002eet.....\.@......
0x10193f4156747970655f696e666f404000c0?AVtype_info@@..
0x10291c400000244000c02c4000602e400010.@..$@..,@.`.@..
0x1039364000703f4000b043400000000000ff[email protected][email protected]@......
0x1049ffffffa5534000a9534000c05a400090[email protected]@..Z@..
0x10591c40008f634000101c40000000000000[email protected]@...@......
0x1069000000ffffffff000000000000000060...............`
0x10791c400000000000000000000000000001.@..............
0x1089000000781c4000000000000000000000...x.@..........
0x1099000000101c4000801c40000000000000.....@...@......
0x10a9000000000000008bc1c700281c4000c3...........(.@..
0x10b990909090909090568bf1e818000000f6.......V........
0x10c944240801740956e83b46000083c4048bD$..t.V.;F......
0x10d9c65ec204009090c701281c4000c39090.^.......(.@....
0x10e9909090909090906aff686864400064a1[email protected].
0x10f900000000506489250000000083ec0c56....Pd.%.......V
0x1109578bf98d4c2408e89b3d00008bcfc744W...L$...=.....D
0x1119241c00000000e8bc0000008b4c24308b$...........L$0.
0x1129f08b4424345051568bcfe8480300008b..D$4PQV...H....
0x113944242c8b4c24288d5424086a02528b54D$,.L$(.T$.j.R.T
0x1149242c50515652e87636000083c41885c0$,PQVR.v6.......
0x11597455568d4c240ce80b450000a0856840tUV.L$...E....h@
0x11690084c074146a0068d011400068d01140[email protected]..@
0x1179006a00ff15a4114000568bcfe8d60500[email protected]......
0x1189008d4c2408c744241cffffffffe8453d..L$..D$......E=
0x119900005fb0015e8b4c240c64890d000000.._..^.L$.d.....
0x11a90083c418c214008d4c2408c744241cff........L$..D$..
0x11b9ffffffe81f3d00008b4c24145f32c05e.....=...L$._2.^

References the Windows debugger output API 0x65d4–0x6854

⋯3 more rows
0x660447657453797374656d4469726563746fGetSystemDirecto
0x66147279410083024f757470757444656275ryA...OutputDebu
0x662467537472696e674100004e024c6f6361gStringA..N.Loca
0x66346c416c6c6f630000bf036c7374726c65lAlloc....lstrle
⋯3 more rows
0x6674757272656e7450726f63657373006400urrentProcess.d.
0x668443726561746552656d6f746554687265CreateRemoteThre
0x669461640000980147657450726f63416464ad....GetProcAdd
0x66a472657373000077014765744d6f64756cress..w.GetModul
0x66b46548616e646c65410000a00357726974eHandleA....Writ
0x66c46550726f636573734d656d6f72790000eProcessMemory..
0x66d476035669727475616c416c6c6f634578v.VirtualAllocEx
0x66e40000af004578697450726f6365737300....ExitProcess.
⋯8 more rows
0x6774686172007c0044656c65746546696c65har.|.DeleteFile
0x67844100cb0147657454656d705061746841A...GetTempPathA
0x67940000b3036c737472636d704100001d03....lstrcmpA....
0x67a45365744c6173744572726f7200003d00SetLastError..=.
0x67b4436f707946696c6541008e0250726f63CopyFileA...Proc
0x67c465737333324e657874008c0250726f63ess32Next...Proc
0x67d46573733332466972737400006c004372ess32First..l.Cr
0x67e465617465546f6f6c68656c703332536eeateToolhelp32Sn
⋯7 more rows

PE company name identifies Microsoft 0x7206–0x74f6

0x720600000000000000000000309200005003..........0...P.
0x721600000000000000000000030045005800............E.X.
0x722645000000000000000000500334000000E.........P.4...
0x7236560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x72464f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯8 more rows
0x72d665006e007400730000004c0016000100e.n.t.s...L.....
0x72e643006f006d00700061006e0079004e00C.o.m.p.a.n.y.N.
0x72f661006d006500000000004d0069006300a.m.e.....M.i.c.
0x730672006f0073006f006600740020004300r.o.s.o.f.t. .C.
0x73166f00720070006f007200610074006900o.r.p.o.r.a.t.i.
0x73266f006e00000038000800010046006900o.n...8.....F.i.
0x73366c006500440065007300630072006900l.e.D.e.s.c.r.i.
0x73467000740069006f006e00000000006900p.t.i.o.n.....i.
0x73566e007300740061006c006c0000003600n.s.t.a.l.l...6.
0x73660b000100460069006c00650056006500....F.i.l.e.V.e.
0x73767200730069006f006e00000000003300r.s.i.o.n.....3.
0x73862c00200030002c00200030002c002000,. .0.,. .0.,. .
0x73963000000000002e000700010049006e000...........I.n.
0x73a67400650072006e0061006c004e006100t.e.r.n.a.l.N.a.
0x73b66d0065000000520075006e0064003300m.e...R.u.n.d.3.
⋯12 more rows
0x748665004200750069006c00640000004c00e.B.u.i.l.d...L.
0x749616000100500072006f00640075006300....P.r.o.d.u.c.
0x74a674004e0061006d006500000000004d00t.N.a.m.e.....M.
0x74b66900630072006f0073006f0066007400i.c.r.o.s.o.f.t.
0x74c6200043006f00720070006f0072006100 .C.o.r.p.o.r.a.
0x74d6740069006f006e0000003a000b000100t.i.o.n...:.....
0x74e6500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x74f665007200730069006f006e0000003300e.r.s.i.o.n...3.

Writable and exe section (W^X violation) 0x2bb80–0x2be50

⋯7 more rows
0x2bbf000000000000000000000000000000000................
0x2bc00b96622430090906822e042005e906898.f"C...h".B.^.h.
0x2bc100500005a9090310c32909083ea0283ea...Z..1.2.......
0x2bc2002909075f1908e5f4200662243006622...u..._B.f"C.f"
0x2bc300300d76c43008b994100bae341006692...lC...A...A.f.
⋯34 more rows