Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 01:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe
Resource
win11-20260513-en
4 signatures
150 seconds
General
- Target 2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe
- Size 2.2MB
- Sample260529-bkn2vsfx4t
- SHA256 f32b911d4a4ce299ce58b89c5857fe7624374b431c4f2943c172137a882a9361
- MD5 b6c2266c8c45493a411c47f2fa8a8919
- SHA1 325c37e3d2543312aee42821d8eef01f8ac014e3
- SHA512 fbd60dff74f3be3da9a7ee595a7d252e87508d9e302131faff66b759ff35bc55e0f4132d76bf618a5df82ac5f8ebcd14061d334d5e627afea4ed4bf114ca87c2
- SSDEEP 24576:+RVx4x2aSqc5EVkTrwAJJ4Uya0TYUkDd6CDtmAWUU4kqMJszrYm4R+9Mt:+Re2fP5GAFya0MUkFxGUUtKzq+9G
- TLSH T19BB5081DFF948DB5E4A241348465872D9632BD118B239E8B22447E9EFFB2F805D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3668 2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3668 2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_b6c2266c8c45493a411c47f2fa8a8919_amadey_elex_glassworm_icedid_njrat_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3668