Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 06:56
General
- Target 2026-05-03_ea909cc983017b55f3c3a6ac856be8df_elex_glassworm_stop.exe
- Size 14.7MB
- Sample260503-hqdlmsgv4n
- SHA256 c5fde360ee7e95ff87ac304365e470a441a084f9891e5d3ea35606d26a792a9a
Malware Config
Signatures
- Detects executables packed with Babel 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_ea909cc983017b55f3c3a6ac856be8df_elex_glassworm_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_ea909cc983017b55f3c3a6ac856be8df_elex_glassworm_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe2⤵
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1592-1999-0x0000000000F90000-0x0000000000FF0000-memory.dmp
memory/1592-2023-0x0000000005530000-0x00000000055B2000-memory.dmp
memory/1592-2214-0x0000000007440000-0x00000000074B6000-memory.dmp
memory/1592-2215-0x0000000007520000-0x000000000753E000-memory.dmp
memory/1592-2216-0x0000000007920000-0x0000000007932000-memory.dmp
memory/3980-1529-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1052-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-11-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-9-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-7-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-6-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-4-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-1-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-23-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-809-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-822-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-1537-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1053-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1051-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1050-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1049-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1048-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-964-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-879-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-817-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-814-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-811-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-808-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-1061-0x00000000FFE30000-0x00000000FFE50000-memory.dmp
memory/3980-1078-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1085-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1110-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1086-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1084-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1082-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1081-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1080-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1079-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1077-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1076-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1075-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1074-0x00000000FFE60000-0x00000000FFE61000-memory.dmp
memory/3980-1083-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1058-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1057-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1056-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1055-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1054-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1203-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1204-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1207-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1209-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1208-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1206-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1205-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1522-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1521-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1531-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1525-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1527-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-0-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1523-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-15-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/3980-1585-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1549-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1559-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1571-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1583-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1601-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1611-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1609-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1607-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1605-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1603-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1599-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1597-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1595-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1593-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1591-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1589-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1587-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1543-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1581-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1579-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1577-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1575-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1573-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1569-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1567-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1565-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1563-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1561-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1557-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1555-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1553-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1551-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1547-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1545-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1541-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1539-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1535-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1533-0x00000000037F0000-0x0000000003841000-memory.dmp
memory/3980-1976-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1979-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1978-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1977-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1980-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1981-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1984-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1983-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1991-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1990-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1989-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1988-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1987-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1986-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1985-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1982-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1992-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1994-0x00000000032E0000-0x00000000033E0000-memory.dmp
memory/3980-1993-0x00000000032E0000-0x00000000033E0000-memory.dmp