Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 16:06
General
- Target 2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe
- Size 15.2MB
- Sample260503-tkfdtsgt5q
- SHA256 dd768bd069a0f67935f5bdf4e8d4701d99bda9aa0a9b8b370591c6a5f2beab8e
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4396-0-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-4-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-15-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-11-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-9-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-7-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-6-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-23-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1123-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1316-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1325-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1324-0x0000000076F32000-0x0000000076F33000-memory.dmp
memory/4396-1309-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1302-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1291-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1284-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1277-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1270-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1263-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1200-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1256-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1249-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1242-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1235-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1228-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1221-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1214-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1207-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1193-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1186-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1179-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1172-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1165-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1158-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1151-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1144-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1137-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1130-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1116-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1109-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1102-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1100-0x00000000015B0000-0x00000000015F8000-memory.dmp
memory/4396-1097-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1094-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1091-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1089-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1088-0x00000000FFC20000-0x00000000FFC21000-memory.dmp
memory/4396-1330-0x00000000FFDA0000-0x00000000FFDC0000-memory.dmp
memory/4396-1344-0x00000000032D0000-0x0000000003321000-memory.dmp
memory/4396-1343-0x00000000FFDD0000-0x00000000FFDD1000-memory.dmp