Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 16:06
General
- Target 2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe
- Size 15.2MB
- Sample260503-tkfdtsgt5q
- SHA256 dd768bd069a0f67935f5bdf4e8d4701d99bda9aa0a9b8b370591c6a5f2beab8e
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 8242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1920 -ip 19201⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1920-0-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-15-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-11-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-9-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-7-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-6-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-5-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-23-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1157-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1213-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1221-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1206-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1199-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1331-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1323-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1316-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1309-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1298-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1291-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1284-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1277-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1270-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1263-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1256-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1249-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1242-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1235-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1228-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1192-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1185-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1178-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1171-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1164-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1150-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1143-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1136-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1129-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1122-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1106-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1097-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1095-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1094-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1051-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1115-0x0000000003260000-0x00000000032A8000-memory.dmp
memory/1920-1108-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1100-0x00000000FFC50000-0x00000000FFC51000-memory.dmp
memory/1920-1332-0x0000000001530000-0x0000000001537000-memory.dmp
memory/1920-1350-0x00000000FFE00000-0x00000000FFE01000-memory.dmp
memory/1920-1337-0x00000000FFDD0000-0x00000000FFDF0000-memory.dmp
memory/1920-1351-0x0000000003380000-0x00000000033D1000-memory.dmp
memory/1920-1499-0x0000000000400000-0x00000000013DA000-memory.dmp