Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 01:37
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
- Size 10.2MB
- Sample260707-b2awkacv6r
- SHA256 733fcf6b51c7519cc1582de9c6cf6f2824b7a0fd455da9be461e4f06ab272326
- MD5 ad28786595b6888b375df8e45cf99f85
- SHA1 fdab086c45ceb11e0fabb8ba54b463f054bf4b0c
- SHA512 7edebd5c77a16389bceaa39e031b1fcbf8509e8712bb300b9a9a6eaf830bdf7a795de310cf0c884bd2c2c1ec3ce0ea83687a195b13c9f9bb392e9e5150d3c564
- SSDEEP 196608:eb3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mKT62ob3bPk5HyC8k5h/wDdEoNiV4I/Wi:eb3bPk5HPhJCKT3ob3bPk5HPhJCKT3
- TLSH T1F5B65A41F5C380B5EEA34574A187F36F9721ED4281209DEBF98C7A86EF33691492E319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\setup16.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\fontview.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\net1.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tar.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.26100.1_none_ab6fa072a46b2ede\EdmGen.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\r\PING.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\ByteCodeGenerator.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\r\CameraBarcodeScannerPreview.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\msconfig.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\r\proquota.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_810636a52f615c2d\psr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_eb22a7e4bb95e7f1\aspnet_regsql.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browserexport.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\r\UCConfigTask.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\r\PresentationHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\desktopimgdownldr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_7f1c6fee223c55e3\mscorsvw.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\r\nslookup.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.26100.1150_none_430cd619cc4d0de3\r\upfc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\CompatTelRunner.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\PkgMgr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_57ca55906b66d7b3\SystemPropertiesPerformance.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\DevicePairingWizard.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\wpr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\r\esentutl.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\ntkrla57.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\relog.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.26100.1_none_4d201f2d5466838a\WmsDashboard.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\explorer.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1150_none_c952c4f3d93cb420\r\DismHost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpupdate.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\r\gpscript.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_a4b0965e18742ee0\aspnet_regbrowsers.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\r\hvsievaluator.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\r\RelPost.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tscon.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\r\RuntimeBroker.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\GenValObj.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiFileFetcher.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVShNotify.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_83f057581aec64ac\OOBEFodSetup.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\scrcons.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCLNWZ.EXE 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmplayer.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_5ac6e18046b72d8c\where.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\Dxpserver.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\r\findstr.exe 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad28786595b6888b375df8e45cf99f85_coinminer_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3752