Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 06:56
General
- Target 2026-05-03_ea909cc983017b55f3c3a6ac856be8df_elex_glassworm_stop.exe
- Size 14.7MB
- Sample260503-hqdlmsgv4n
- SHA256 c5fde360ee7e95ff87ac304365e470a441a084f9891e5d3ea35606d26a792a9a
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_ea909cc983017b55f3c3a6ac856be8df_elex_glassworm_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_ea909cc983017b55f3c3a6ac856be8df_elex_glassworm_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4804-0-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-4-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-15-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-11-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-9-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-7-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-6-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-23-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-776-0x0000000077702000-0x0000000077703000-memory.dmp
memory/4804-823-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-1051-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1052-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1069-0x00000000FFE30000-0x00000000FFE31000-memory.dmp
memory/4804-1070-0x0000000003570000-0x00000000035C1000-memory.dmp
memory/4804-1056-0x00000000FFE00000-0x00000000FFE20000-memory.dmp
memory/4804-1053-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1049-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1048-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1047-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1050-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-809-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-818-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-815-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-812-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-810-0x00000000FFC80000-0x00000000FFC81000-memory.dmp
memory/4804-1186-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1189-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1193-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1195-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1194-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1192-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1191-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1190-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1188-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1187-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1196-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1197-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1199-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1200-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1198-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1201-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1202-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1203-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1205-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1204-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1207-0x00000000019B0000-0x0000000001AB0000-memory.dmp
memory/4804-1206-0x00000000019B0000-0x0000000001AB0000-memory.dmp