Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 12:11
General
- Target 2026-04-16_8096e578d0fc281fe53ccdc2e3678f6e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
- Size 2.4MB
- Sample260416-pcvrbsht2y
- SHA256 ed9817ea6527bb1bb5fc19152739b83aecf848f41822425a23746ba15a5fb300
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_8096e578d0fc281fe53ccdc2e3678f6e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_8096e578d0fc281fe53ccdc2e3678f6e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1064-10-0x00000181BCC70000-0x00000181BCC78000-memory.dmp
memory/1064-19-0x00000181BEBC0000-0x00000181BEBD0000-memory.dmp
memory/1064-17-0x00000181BEBC0000-0x00000181BEBD0000-memory.dmp
memory/1064-14-0x00000181BEBC0000-0x00000181BEBD0000-memory.dmp
memory/1064-11-0x00000181D72B0000-0x00000181D7438000-memory.dmp
memory/5108-8-0x0000000005620000-0x0000000005630000-memory.dmp
memory/5108-6-0x0000000005C70000-0x0000000006216000-memory.dmp
memory/5108-7-0x0000000005760000-0x00000000057F2000-memory.dmp
memory/5108-0-0x0000000005620000-0x0000000005630000-memory.dmp
memory/5108-9-0x0000000005970000-0x0000000005B1E000-memory.dmp
memory/5108-5-0x0000000001720000-0x0000000001744000-memory.dmp
memory/5108-4-0x0000000005630000-0x00000000056BE000-memory.dmp
memory/5108-12-0x0000000005620000-0x0000000005630000-memory.dmp
memory/5108-3-0x00000000016F0000-0x00000000016F8000-memory.dmp
memory/5108-13-0x0000000005620000-0x0000000005630000-memory.dmp
memory/5108-2-0x0000000005620000-0x0000000005630000-memory.dmp
memory/5108-1-0x0000000001630000-0x0000000001638000-memory.dmp