Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 22:50
General
- Target 2026-04-21_239a1f9275223f8c75050c3c32fa7193_elex_fabookie_glassworm_hacktools_mimikatz_qilin.exe
- Size 2.3MB
- Sample260421-2sg7dsgx2x
- SHA256 cf89641e4d73c6206826db812ae8e25f7d949d31ba209f06f5daeab7ee28bef5
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Family: SharpHound
SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.
- Detects SharpHound hacktool 1 IoCs
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_239a1f9275223f8c75050c3c32fa7193_elex_fabookie_glassworm_hacktools_mimikatz_qilin.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_239a1f9275223f8c75050c3c32fa7193_elex_fabookie_glassworm_hacktools_mimikatz_qilin.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/788-0-0x000002A335800000-0x000002A335A48000-memory.dmp
memory/788-1-0x000002A335EC0000-0x000002A335ED0000-memory.dmp