1ffe0e1b9a960768d341af0376b68fef3465dcef96d2f85f7bc6cc9492fa1ab0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_97741c973da260b1eeda524ad5bba866_conti_elex_glassworm.exe
Size 380KB
Sample260420-kyrvcahy21
SHA256 1ffe0e1b9a960768d341af0376b68fef3465dcef96d2f85f7bc6cc9492fa1ab0
MD5 97741c973da260b1eeda524ad5bba866
SHA1 81e75a1338917dda9aa5e982c97e97602f18b9bb
SHA512 2de46f96b3a76feb0670f37972294352f447c78bd7086210389dc2fc761d8f6b6f35c16ff3b6c65c7309951f01ca2e4f192cb8e3c0e4413f8b52a444c716ae60
SSDEEP 6144:mBA+TyihnlaHfAo/BJ/Ga3WBNU6ITLUy1NHOKgUt6ud:sXhnldnBNUbTYfUT
TLSH
T10584293BEE28ECE2C27A8D785691C740A77278714F61A3CBD164C30E9E236D05E76D25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5096	1776	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_97741c973da260b1eeda524ad5bba866_conti_elex_glassworm.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_97741c973da260b1eeda524ad5bba866_conti_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_97741c973da260b1eeda524ad5bba866_conti_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 892
  2⤵
  - Program crash
  PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1776 -ip 1776
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-0-0x0000000000760000-0x000000000076A000-memory.dmp

Download

memory/1776-1-0x0000000005140000-0x000000000528D000-memory.dmp