Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 01:37
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
- Size 10.2MB
- Sample260707-b2awkacv6r
- SHA256 733fcf6b51c7519cc1582de9c6cf6f2824b7a0fd455da9be461e4f06ab272326
- MD5 ad28786595b6888b375df8e45cf99f85
- SHA1 fdab086c45ceb11e0fabb8ba54b463f054bf4b0c
- SHA512 7edebd5c77a16389bceaa39e031b1fcbf8509e8712bb300b9a9a6eaf830bdf7a795de310cf0c884bd2c2c1ec3ce0ea83687a195b13c9f9bb392e9e5150d3c564
- SSDEEP 196608:eb3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mKT62ob3bPk5HyC8k5h/wDdEoNiV4I/Wi:eb3bPk5HPhJCKT3ob3bPk5HPhJCKT3
- TLSH T1F5B65A41F5C380B5EEA34574A187F36F9721ED4281209DEBF98C7A86EF33691492E319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral1/files/0x00010000000081ea-4.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00010000000081ea-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mshta.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wextract.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\user.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sfc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tar.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\f\AxInstUI.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.19041.1_none_dd2098e5f9122dff\findstr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsimgr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_19667e7e60cb0ccd\RdpSaProxy.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\r\Win32WebViewHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpshare.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_bafc9f61651f37d2\SystemUWPLauncher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.CscUnpinTool.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\CastSrv.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\f\CameraBarcodeScannerPreview.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\iisreset.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\f\desktopimgdownldr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\rundll32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\LocationNotificationWindows.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\f\Magnify.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\smss.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\n\InputApp\TextInputHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.19041.1_none_193aab8d8b539746\Register-CimProvider.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\r\CertEnrollCtrl.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\r\netbtugc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\r\EoAExperiences.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFaultSecure.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\f\UtcDecoderHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\MusNotificationUx.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_c719fa2e662738e0\WPDShextAutoplay.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\AtBroker.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\fltMC.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\r\BioIso.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\spaceman.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\f\sessionmsg.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.19041.1_none_afd43cb1c2b70f77\wlanext.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chglogon.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WMIADAP.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_9fe20fdb296d6341\r\edpnotify.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\cttunesvr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\r\wecutil.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\TSWbPrxy.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\XblGameSaveTask.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmplayer.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\f\winresume.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\cmimageworker.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.19041.1_none_83ab1c56c187ef65\Windows.WARP.JITService.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\raserver.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\f\SystemUWPLauncher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\setup.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.84_none_9f3e49455f52d8f7\f\dxgiadaptercache.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\audit.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_31431424ec14de3f\RdpSa.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchFilterHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\f\autofmt.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\fixmapi.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\f\csrss.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.264_none_c765d8a6c76ec25f\f\DataExchangeHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\f\MuiUnattend.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\TRACERT.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvax64.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVDllSurrogate.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 13.1MB
- SHA256 5870900c1819e51b3c847c8878ddcaddcda9959e5922694f883f85c06ff5d819
- MD5 92530154b8a6b3f5307df53480104847
- SHA1 b6ed9f8e36a050326818dc491a8858e8a99ac148
- SHA512 68d31bcdb0a697bcacbe6b8cfde97d607fc91d4ee7a793fe70567c24238722417ec7c7cdaf93fe002753103c991ce91ff8b94ef736a2cb9a193f5b0e28b375dc
- SSDEEP 393216:eb3bPk5HPhJCKT3ob3bPk5HPhJCKT3IGi:+WhVz4WhVz
- TLSH T112D66C41E6C380F5DEA385749193F36FE731BC4181209DEBF9987A46AF336914A2E319
- MD5 SHA1 SHA512 SSDEEP TLSH