Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 17:18
Behavioral task
behavioral1
Sample
2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
- Size 1.7MB
- Sample260503-vvfb9aev2z
- SHA256 52943fd960cf80c07401218bc9548337f0a2af785fabf67cfaaa0b745a83cc22
- MD5 888c150d1073d3a4cbf497d688e591b7
- SHA1 9b268549d2614f6ef99e139e8ac202e7eed31bdd
- SHA512 25bc837e7ec39ce3559ff8d57e9e63cf133d230bab42aebfa957f7a85919108b7b6c605bf5405c8163e3f2b28f2d4d09398c44e5e9065058e7ae251161e8b924
- SSDEEP 24576:cGtJQzN/AUKd/Yp5zKHr36daE/ol4uuJ5MeJ5M6Q:/tGzNIUg/6FKLXW04uq5M65M6Q
- TLSH T1A0859E02F7E0C272C5AA46318CA7939E1739FD215B224BDBA7843F2D1E723C05E79956
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 3308 created 616 3308 Explorer.EXE 5 PID 4840 created 616 4840 nslookup.exe 5 - Detects executables packed with VMProtect. 23 IoCs
resource yara_rule behavioral1/memory/2876-0-0x0000000000B70000-0x0000000000C77000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2876-1-0x0000000000B70000-0x0000000000C77000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2876-5-0x0000000000B70000-0x0000000000C77000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/3308-19-0x00000000090C0000-0x0000000009355000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/3308-20-0x00000000090C0000-0x0000000009355000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-31-0x000001BE5CDE0000-0x000001BE5D047000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-35-0x000001BE5CDE0000-0x000001BE5D047000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-34-0x000001BE5CDE0000-0x000001BE5D047000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-41-0x000001BE5CDE0000-0x000001BE5D047000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/3308-46-0x00000000090C0000-0x0000000009355000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-48-0x000001BE5CDE0000-0x000001BE5D047000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4840-55-0x00000276078F0000-0x0000027607B85000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4840-56-0x00000276078F0000-0x0000027607B85000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2904-67-0x000001F044350000-0x000001F0445B7000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2904-69-0x000001F044350000-0x000001F0445B7000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2904-76-0x000001F044350000-0x000001F0445B7000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4840-88-0x00000276078F0000-0x0000027607B85000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-93-0x000001BE5F120000-0x000001BE5F426000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-91-0x000001BE5F120000-0x000001BE5F426000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-97-0x000001BE5F740000-0x000001BE5F91B000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/4548-98-0x000001BE5F740000-0x000001BE5F91B000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/files/0x000700000000073f-126.dat INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2876-222-0x0000000000B70000-0x0000000000C77000-memory.dmp INDICATOR_EXE_Packed_VMProtect - Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\System32\drivers\LVv0OO.sys forfiles.exe File opened for modification C:\Windows\system32\drivers\IYSxjK1KJh0v.sys forfiles.exe File opened for modification C:\Windows\system32\drivers\QINDgxP7PD88Tq.yoc forfiles.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe - Executes dropped EXE 2 IoCs
pid Process 4548 forfiles.exe 2904 conhost.exe - Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2904 conhost.exe -
resource yara_rule behavioral1/memory/2876-0-0x0000000000B70000-0x0000000000C77000-memory.dmp vmprotect behavioral1/memory/2876-1-0x0000000000B70000-0x0000000000C77000-memory.dmp vmprotect behavioral1/memory/2876-5-0x0000000000B70000-0x0000000000C77000-memory.dmp vmprotect behavioral1/memory/3308-19-0x00000000090C0000-0x0000000009355000-memory.dmp vmprotect behavioral1/memory/3308-20-0x00000000090C0000-0x0000000009355000-memory.dmp vmprotect behavioral1/memory/3308-46-0x00000000090C0000-0x0000000009355000-memory.dmp vmprotect behavioral1/memory/4840-55-0x00000276078F0000-0x0000027607B85000-memory.dmp vmprotect behavioral1/memory/4840-56-0x00000276078F0000-0x0000027607B85000-memory.dmp vmprotect behavioral1/memory/4840-88-0x00000276078F0000-0x0000027607B85000-memory.dmp vmprotect behavioral1/memory/4548-93-0x000001BE5F120000-0x000001BE5F426000-memory.dmp vmprotect behavioral1/memory/4548-91-0x000001BE5F120000-0x000001BE5F426000-memory.dmp vmprotect behavioral1/files/0x000700000000073f-126.dat vmprotect behavioral1/memory/2876-222-0x0000000000B70000-0x0000000000C77000-memory.dmp vmprotect - Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7E8E.cat forfiles.exe File opened for modification C:\Windows\system32\aea2XQOC8W.alt forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7EBE.cat forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7F4B.cat forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7F78.cat forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7FD8.cat forfiles.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\6U996xj.cat forfiles.exe File opened for modification C:\Windows\system32\uQqDP1c7rYO.sys forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7F1B.cat forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7FA8.cat forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D8005.cat forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D8035.cat forfiles.exe File created C:\Windows\system32\ \Windows\System32\3paxPnEaP.sys forfiles.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7E61.cat forfiles.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files\AUTqVlKMrSXBur.sys forfiles.exe File opened for modification C:\Program Files\hbwnsLWmnG.eus forfiles.exe File opened for modification C:\Program Files (x86)\myPbMc3zgAbuzV.jue forfiles.exe File opened for modification C:\Program Files\Java\39675b38.js forfiles.exe File opened for modification C:\Program Files\Java\47c13206.html forfiles.exe File opened for modification C:\Program Files\Java\lib\6474dfa2.js forfiles.exe File opened for modification C:\Program Files (x86)\oP37gNVCLoKa.sys forfiles.exe File opened for modification C:\Program Files\Java\manifest.json forfiles.exe File opened for modification C:\Program Files\Java\561b08d4.js forfiles.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\forfiles.exe Explorer.EXE File created C:\Windows\Help\conhost.exe nslookup.exe File opened for modification C:\Windows\Help\conhost.exe nslookup.exe File created C:\Windows\IOCPso1g.sys forfiles.exe File opened for modification C:\Windows\uPc85nHWfI.sys forfiles.exe File opened for modification C:\Windows\X4IL7v6uGVIrT.xrh forfiles.exe File created C:\Windows\Fonts\forfiles.exe Explorer.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3772 TRACERT.EXE - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 forfiles.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName forfiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 forfiles.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3956 timeout.exe - Modifies data under HKEY_USERS 16 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ forfiles.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix forfiles.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" forfiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" forfiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" forfiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" forfiles.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" forfiles.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" forfiles.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 3308 Explorer.EXE 4840 nslookup.exe 4840 nslookup.exe 4840 nslookup.exe 4840 nslookup.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe 4548 forfiles.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3308 Explorer.EXE - Suspicious behavior: LoadsDriver 19 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe Token: SeTcbPrivilege 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe Token: SeDebugPrivilege 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe Token: SeDebugPrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe Token: SeDebugPrivilege 4840 nslookup.exe Token: SeDebugPrivilege 4840 nslookup.exe Token: SeDebugPrivilege 4548 forfiles.exe Token: SeDebugPrivilege 4548 forfiles.exe Token: SeDebugPrivilege 4548 forfiles.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 4548 forfiles.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 3772 TRACERT.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeDebugPrivilege 4548 forfiles.exe Token: SeBackupPrivilege 4548 forfiles.exe Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE Token: SeCreatePagefilePrivilege 3308 Explorer.EXE Token: SeShutdownPrivilege 3308 Explorer.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3308 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 56 PID 2876 wrote to memory of 3308 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 56 PID 2876 wrote to memory of 3308 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 56 PID 3308 wrote to memory of 4548 3308 Explorer.EXE 102 PID 3308 wrote to memory of 4548 3308 Explorer.EXE 102 PID 3308 wrote to memory of 4548 3308 Explorer.EXE 102 PID 3308 wrote to memory of 4548 3308 Explorer.EXE 102 PID 2876 wrote to memory of 4840 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 105 PID 2876 wrote to memory of 4840 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 105 PID 2876 wrote to memory of 4840 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 105 PID 2876 wrote to memory of 4840 2876 2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe 105 PID 4840 wrote to memory of 2904 4840 nslookup.exe 107 PID 4840 wrote to memory of 2904 4840 nslookup.exe 107 PID 4840 wrote to memory of 2904 4840 nslookup.exe 107 PID 4840 wrote to memory of 2904 4840 nslookup.exe 107 PID 3308 wrote to memory of 4644 3308 Explorer.EXE PID 3308 wrote to memory of 3656 3308 Explorer.EXE PID 3308 wrote to memory of 4696 3308 Explorer.EXE PID 4548 wrote to memory of 3772 4548 forfiles.exe 111 PID 4548 wrote to memory of 3772 4548 forfiles.exe 111 PID 4548 wrote to memory of 3772 4548 forfiles.exe 111 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 4548 wrote to memory of 3308 4548 forfiles.exe 56 PID 3308 wrote to memory of 4992 3308 Explorer.EXE PID 3308 wrote to memory of 2016 3308 Explorer.EXE PID 3308 wrote to memory of 204 3308 Explorer.EXE PID 3308 wrote to memory of 3944 3308 Explorer.EXE PID 3308 wrote to memory of 3832 3308 Explorer.EXE PID 3308 wrote to memory of 4588 3308 Explorer.EXE PID 3308 wrote to memory of 5080 3308 Explorer.EXE PID 3308 wrote to memory of 1684 3308 Explorer.EXE PID 3308 wrote to memory of 2280 3308 Explorer.EXE PID 3308 wrote to memory of 1016 3308 Explorer.EXE PID 3308 wrote to memory of 4812 3308 Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Fonts\forfiles.exe"C:\Windows\Fonts\forfiles.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\TRACERT.EXE"C:\Windows\system32\TRACERT.EXE"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
-
C:\Windows\Help\conhost.exe"C:\Windows\Help\conhost.exe"2⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Modifies data under HKEY_USERS
PID:2904
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:980
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3956
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Fonts\forfiles.exe
- Size 51KB
- SHA256 9b4886f187489a190bb2c412772c1998539f086c63a4cfd72ff3b107cbc21907
- MD5 9bb67aea5e26cb136f23f29cc48d6b9e
- SHA1 cabee28f7368aae1ac23f0713e2c330f96af2062
- SHA512 ac1ea7be97cadce0abf3b581a97b32cceecdc5e7015704ef6a08e33d47f928aab4758df61efb9856057c09d31629ea080f9525b199daebaa4b945338086411bb
- SSDEEP 1536:3vFQXxbEZhhnGU3Yk8aoBgkRfnt6xCxggRL:3exAZhhnGU3Yk7kRyCxgU
- TLSH T14233071E63A831F9E866D278D5521213D272B4323B3156FF53E0CA789B13AD2B675F02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Help\conhost.exe
- Size 848KB
- SHA256 51bb5aeef2e48dd14fae764f80dc67f516df9914ea9c350329e229f6cea919a2
- MD5 63a31f47716fdaae337e01a231cc2544
- SHA1 2804a88016d8341f5bc6ee7c3fa7b310d3488859
- SHA512 e143e149f17929140a3bd2e346f0cdd5447ab4639f2e236df330471933ec9d5657f9d0d1fd2cb54dc2cc97239fc990f004a25f8122bfcf75549b6ddd65f1d184
- SSDEEP 24576:uqkwFs5YddRkadhmAb5whmJT5OIWe7Zw:uf5YddRkomAmmJNLWe1w
- TLSH T1F0056C1EA6AC01E5D07AD07CC583CA2AF6713815037597CF01A0867E6F2BBE96E3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D7EBE.cat
- Size 5KB
- SHA256 494280628758aaad9ca11c5843af59d3292d8680151ea8302fd9c1db612006b2
- MD5 14abf2b885340e7205a4a6e5ce993c9a
- SHA1 7d14cf5d84075cdf87315a60902bc910a0db8fbf
- SHA512 ac802361b3b467944437688be21211f2c1946cab12d66467c74359a07b33d9a9fda54776d2a11fa799ab3e498c80a3354883e3386717a52e85e56401fd629d24
- SSDEEP 96:dyDmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOG1:DIrXL0UIRIzw3jtlAur9ZCspE+TMQrO8
- TLSH T1B4B1C6D709082456EC865B91D5C6D66FED3467A52EC861A680B291992EC3BF07B0E80F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\uPc85nHWfI.sys
- Size 171KB
- SHA256 7860ba948f5df7266d40724ac9dd430afe36b7462eb41a96871116b01141d3d3
- MD5 696d4e10f25431a27ed9c92ff514e5e5
- SHA1 116d9aa544743ccfddddd3af42c3f95e17980ed4
- SHA512 be90281b054c4eb2d7c1a0cf15a86b34b03b54de3d17352ffd0bb776abf1dcbc0687ab9aa5b86b9af92aca98264d7982f9d84201ed21a4109ebdf63406029a18
- SSDEEP 3072:a+IaIfIEHlbySWsjhWDodnRlzYVucprnuRbW6kR/eKPkW79imuWgDSgpLIgWy:7INg4bYsjKodR567prnQW6u/e2Zidl
- TLSH T1810412C290D891F3D50C54BCBA5351E882E8307BE921C369F9443FBDBC5519AED42ADA
- MD5 SHA1 SHA512 SSDEEP TLSH