Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 02:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
- Size 2.1MB
- Sample260511-dc6caaaw6x
- SHA256 61852c37f98d62a6feeb612230729754e055d72b382ee8105d86c1057fbb82e6
- MD5 7bcc2bebc764e8b8e3d023d561dc8658
- SHA1 e87f85616a8faf889dc2973a94b37b3234bd0fbc
- SHA512 212c6d51d320fc39a3115e6f1fefb48ba53744f1c90e9428a709d952d27d05832e48498a5303e2764fbbe3c158e1dff5e248ab9f7c035047875e28d6c8490879
- SSDEEP 24576:kpi6xzVkUetVI5uKVWKWSpXI+BN+kJwEj+KoIMvnrPOyYVENHxJqsaS2RO3:kpPZuyWSG+BBvGvnjOyYVGlqRO3
- TLSH T1F4A5AF156280133BE4D221F1907E2351066479F81B31D3E7F688B98EA973BD3593BBE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001e00000002ad6d-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\comp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\regini.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\recover.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\choice.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\write.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\icacls.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mshta.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PING.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.22000.1_none_394d6561ecf74d41\mqbkup.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.22000.1_none_da2a87582afb2453\UserOOBEBroker.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.22000.1_none_c036c8699ff31951\TapiUnattend.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.22000.1_none_4c569ced0ca81910\setup16.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\r\eshell.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.22000.1_none_e267df21b2c3a4b4\easinvoker.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseSampleUploader.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.22000.1_none_bbcd41b69cc34513\diskraid.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.22000.1_none_909c5510a5987a0e\colorcpl.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.22000.1_none_772ade6a0d9b8f2a\ldifde.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\tree.com- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\r\RMActivate_ssp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.22000.1_none_010c2089229afa0b\fsavailux.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.318_none_40ba790c85795e91\f\BioIso.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\r\printui.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_518c740df132d17d\f\tar.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\f\FilePicker.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.22000.1_none_9aa7aae5bb401974\fontview.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.22000.1_none_bad94eac3141fbc7\bdeunlock.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.318_none_de01ffa2be1c4596\r\memtest.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_823a5b3dd9c522d8\net1.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.22000.1_none_81e69386fbb62c17\AuthHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.22000.1_none_3d7fbabd1601d8b8\cmdkey.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_b0e36fb9b88e8b56\f\certutil.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\RecoveryDrive.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.22000.1_none_845be02a96edce3b\dxdiag.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\hh.exe 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\ResetEngine.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\Taskmgr.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\f\vfpctrl.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\r\TextInputHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.22000.120_none_898d9e6ac325eeaf\AccountsControlHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\LogonUI.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.1_none_779cfeaf71418a8c\lpremove.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrshost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\f\memtest.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.22000.1_none_a631d85ed7b16283\aspnet_regbrowsers.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\audiodg.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_eb6ed0d1cadda675\r\dcdiag.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.22000.434_none_8c92a0565e9eec19\f\bootmgr.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chgport.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_9be8d99ac1f7c734\RegAsm.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_518c740df132d17d\tar.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\f\CapturePicker.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.22000.1_none_0367376385127fe1\FXSSVC.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.22000.1_none_d4a473e8ed9480cf\smss.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\f\RdpSaUacHelper.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_7bcc2bebc764e8b8e3d023d561dc8658_coinminer_elex_glassworm_redline-stealer_rhadamanthys_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.7MB
- SHA256 c4426dc45d59a8dcd9f8647e5da54f391abeab89361a9bff10dd71f61ef15bf0
- MD5 e7839bc757c87bdab26365bd30ea8e7d
- SHA1 6e73567e73de731d9e30c6b26d0d3067e9e7e861
- SHA512 6db143b036b363e92fea675c953f1f5d229ee61a77282c65b64ea74becefcb712e4ecc33a439cbf387c5bc395633f6be4035ff8962a0609da02f7b732633e4e5
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqROPPji0Ajc:khpBinjOykGljog
- TLSH T1E0D58D15B2804337E0E250B5C0BE63458A7175B81B31D3D7B688F65D6E73BD2893ABB2
- MD5 SHA1 SHA512 SSDEEP TLSH