neshta | b1eaf1a2a387f4379a54d135b430958b8ed7d4aeb60107a92fcecde765438945

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
Size 9.4MB
Sample260928-eexnlavzgz
SHA256 b1eaf1a2a387f4379a54d135b430958b8ed7d4aeb60107a92fcecde765438945
MD5 8103acbf9a0607b8cb74445a27c0d5c0
SHA1 1f828ebee8cb4bc8dfe61a6aab5f25ea77e0f8dd
SHA512 846665c42efdaeb8ef6565feb773099d58932dd0827218e19188f5decfddeef4adf5889e78023b985fd29e47810fdd0b780ae3eb63db17b173b0452a9e86529c
SSDEEP 98304:BDCYhLAuFQTIVI2+z0ZwBDbyxB7gIB7sIkKNdS5xx5fIzfTVUyh/4n41ofw6NjBy:PYI9Nux5fqVzh/4i60cOHV45Q
TLSH
T109A66B137C8688F7C1232F75545DCB7B53B2BA144B7485C392EC262D2AB8F929329D36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c586-10.dat	family_neshta
behavioral2/files/0x000e00000001c57a-24.dat	family_neshta
behavioral2/memory/2484-149-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2484-151-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2484-153-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2484-156-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 4 IoCs

pid	Process
1268	svchost.exe
2484	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
2088	svchost.exe
4572	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\MpCmdRun.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	svchost.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	svchost.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svchost.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	svchost.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
File opened for modification	C:\Windows\svchost.com	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1268	2868	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe	88
PID 1268 wrote to memory of 2484	1268	svchost.exe	89
PID 2484 wrote to memory of 4572	2484	2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4572

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
Size 9.4MB
SHA256 cecd12804f731abde41817b1b5ca3b33e08a7ee9036cad71bbaf10e5fa680a5d
MD5 7aa9bc72c8764592524e33ef855e404b
SHA1 597c083cd9745b47634232ea47f39e9e0d88ddbd
SHA512 b4e53b6a73595036dc7812dd69ab91cf61c227f8e3aa163ef9ce95081979e0886bfee4e10ee94fc32ce66ae7c7b555a532858dc819524eb886e0e932994ef104
SSDEEP 98304:DZCYhLAuFQTIVI2+z0ZwBDbyxB7gIB7sIkKNdS5xx5fIzfTVUyh/4n41ofw6NjB+:bYI9Nux5fqVzh/4i60cOHV45M
TLSH
T14FA66B137C8688F7C1232F75545DCB7B53B2BA144B7485C392EC262D2AB8F929329D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-27_8103acbf9a0607b8cb74445a27c0d5c0_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
Size 9.3MB
SHA256 9a6a501d816e34171087f8e8ed017c6833bd62d3279e574d7018557525b8240f
MD5 8ad3b5272b23621bc9d1ab23edc52955
SHA1 5b4877f2e63e987945ed42309e06eeba96f2e170
SHA512 0050606b62ee9ca2bf27f9bd359d563a5192fdc9c1d44839de675bd21ef76656cba5f6af5b31774548cc45137c744c31487d7ac3389ac19ffae2fab2d17dd7bb
SSDEEP 98304:mCYhLAuFQTIVI2+z0ZwBDbyxB7gIB7sIkKNdS5xx5fIzfTVUyh/4n41ofw6NjBtl:8YI9Nux5fqVzh/4i60cOHV45
TLSH
T1F3A66B137C8688F7C1232F75545DCB7B53B2BA144B7485C392EC262D2AB8F929329D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 bf355cb3b86fba368a6d2425f360e330062e57810ceef5f6c5732da351289a7e
MD5 ce8e6f6bd4480dd9e78d151784e3afa1
SHA1 19fc851ad0636a1f8d6a0d967f49a930919ae809
SHA512 9b821db4415de6eaa7928157de6f1742f3d43f1cdf9b81cdf3a6ee83608bcaa06d71f067f952533579ba48abfdff80c942ca5af871fd35b869436d981c1a118a
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJUNyhjPz:JxqjQ+P04wsmJCor
TLSH
T1EF136CA6F6E18831D0201EFC9C1AD264D53B3A313D6A2BF2BAE50D4DDC6D7D22D1C54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 35KB
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
SSDEEP 768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j
TLSH
T122F2F72B5491EC7AC8A212F026BD0F26C376C9B0B854E58ADBC42D6B75A11D2F1B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-14-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2088-157-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2088-163-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2088-150-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2484-149-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2484-153-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2484-156-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2484-151-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2868-5-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads