Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 02:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
- Size 2.1MB
- Sample260511-dc6caaaw6x
- SHA256 61852c37f98d62a6feeb612230729754e055d72b382ee8105d86c1057fbb82e6
- MD5 7bcc2bebc764e8b8e3d023d561dc8658
- SHA1 e87f85616a8faf889dc2973a94b37b3234bd0fbc
- SHA512 212c6d51d320fc39a3115e6f1fefb48ba53744f1c90e9428a709d952d27d05832e48498a5303e2764fbbe3c158e1dff5e248ab9f7c035047875e28d6c8490879
- SSDEEP 24576:kpi6xzVkUetVI5uKVWKWSpXI+BN+kJwEj+KoIMvnrPOyYVENHxJqsaS2RO3:kpPZuyWSG+BBvGvnjOyYVGlqRO3
- TLSH T1F4A5AF156280133BE4D221F1907E2351066479F81B31D3E7F688B98EA973BD3593BBE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x0003000000022b7e-3.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iscsicli.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\label.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\format.com- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\print.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\BHO\ie_to_edge_stub.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\WinMgmt.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_da90d957e87f3409\ImagingDevices.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpconfig.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\r\WpcUapApp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.1_none_6905f2230c3224a7\djoin.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_bb535abd48713dff\wecutil.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\f\imecfmui.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\r\EASPolicyManagerBrokerHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\ssh-keyscan.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\r\setupugc.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_d16ea4809a87fadb\WPDShextAutoplay.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\f\MusNotificationUx.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\hvsiproxyapp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\r\notepad.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.19041.1_none_69cd9c22cfcf9358\plasrv.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCncProxy.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\SecurityHealthService.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_a37f8905d149f29b\PackagedCWALauncher.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_992adeb39ce930a0\PackagedCWALauncher.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\ApplySettingsTemplateCatalog.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\r\InputSwitchToastHandler.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.84_none_3e82ed1fe15c67db\rstrui.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1_none_b0493212512a7f1a\ntprint.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\r\winload.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\r\wbengine.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\r\wkspbroker.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_10.0.19041.1_none_27a74d404373e881\DataSvcUtil.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\f\OpenWith.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\logoff.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.19041.1_none_d31059e0b2fa6d47\aspnet_regiis.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\r\csrss.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.1052_none_073e2a212d1697e6\r\ApproveChildRequest.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\f\pcaui.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\r\MuiUnattend.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\omadmclient.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-ldr64_exe_31bf3856ad364e35_10.0.19041.1_none_538a6445ed07333b\Ldr64.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_6df323382219b604\PickerHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\f\wscadminui.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_233b627ec80a87f1\xcopy.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.84_none_9f3e49455f52d8f7\f\dxgiadaptercache.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\MusNotificationUx.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFault.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\wbadmin.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\f\dwm.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.19041.1_none_65a5646e8443d0f8\MicrosoftEdgeDevTools.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_20798db5235046f8\provlaunch.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\winhlp32.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\unsecapp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_6b184251474f0fac\w3wp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchFilterHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\dxgiadaptercache.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_512e9d368c70b758\iexplore.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\lpksetup.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_a2fa28d9db4c0081\w32tm.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\find.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.7MB
- SHA256 c4426dc45d59a8dcd9f8647e5da54f391abeab89361a9bff10dd71f61ef15bf0
- MD5 e7839bc757c87bdab26365bd30ea8e7d
- SHA1 6e73567e73de731d9e30c6b26d0d3067e9e7e861
- SHA512 6db143b036b363e92fea675c953f1f5d229ee61a77282c65b64ea74becefcb712e4ecc33a439cbf387c5bc395633f6be4035ff8962a0609da02f7b732633e4e5
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqROPPji0Ajc:khpBinjOykGljog
- TLSH T1E0D58D15B2804337E0E250B5C0BE63458A7175B81B31D3D7B688F65D6E73BD2893ABB2
- MD5 SHA1 SHA512 SSDEEP TLSH