52943fd960cf80c07401218bc9548337f0a2af785fabf67cfaaa0b745a83cc22

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Size 1.7MB
Sample260503-vvfb9aev2z
SHA256 52943fd960cf80c07401218bc9548337f0a2af785fabf67cfaaa0b745a83cc22
MD5 888c150d1073d3a4cbf497d688e591b7
SHA1 9b268549d2614f6ef99e139e8ac202e7eed31bdd
SHA512 25bc837e7ec39ce3559ff8d57e9e63cf133d230bab42aebfa957f7a85919108b7b6c605bf5405c8163e3f2b28f2d4d09398c44e5e9065058e7ae251161e8b924
SSDEEP 24576:cGtJQzN/AUKd/Yp5zKHr36daE/ol4uuJ5MeJ5M6Q:/tGzNIUg/6FKLXW04uq5M65M6Q
TLSH
T1A0859E02F7E0C272C5AA46318CA7939E1739FD215B224BDBA7843F2D1E723C05E79956
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery spyware trojan vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3124 created 636	3124	Explorer.EXE	5

Detects executables packed with VMProtect. 16 IoCs

resource	yara_rule
behavioral2/memory/4616-0-0x0000000000E00000-0x0000000000F07000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4616-1-0x0000000000E00000-0x0000000000F07000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4616-15-0x0000000000E00000-0x0000000000F07000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3124-19-0x0000000005C50000-0x0000000005EE5000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3124-21-0x0000000005C50000-0x0000000005EE5000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-31-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-38-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-41-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3124-44-0x0000000005C50000-0x0000000005EE5000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-46-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-71-0x0000020E40D80000-0x0000020E40F5B000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-72-0x0000020E40D80000-0x0000020E40F5B000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-79-0x0000020E41490000-0x0000020E41796000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4780-81-0x0000020E41490000-0x0000020E41796000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/files/0x000700000000068d-103.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4616-195-0x0000000000E00000-0x0000000000F07000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\GGmqQ0.sys	replace.exe
File opened for modification	C:\Windows\system32\drivers\Km3yeirIuwy.sys	replace.exe
File opened for modification	C:\Windows\system32\drivers\rpMoahlzFLlZ.yvm	replace.exe

Executes dropped EXE 1 IoCs

pid	Process
4780	replace.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	4780	replace.exe

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4616-0-0x0000000000E00000-0x0000000000F07000-memory.dmp	vmprotect
behavioral2/memory/4616-1-0x0000000000E00000-0x0000000000F07000-memory.dmp	vmprotect
behavioral2/memory/4616-15-0x0000000000E00000-0x0000000000F07000-memory.dmp	vmprotect
behavioral2/memory/3124-19-0x0000000005C50000-0x0000000005EE5000-memory.dmp	vmprotect
behavioral2/memory/3124-21-0x0000000005C50000-0x0000000005EE5000-memory.dmp	vmprotect
behavioral2/memory/3124-44-0x0000000005C50000-0x0000000005EE5000-memory.dmp	vmprotect
behavioral2/memory/4780-79-0x0000020E41490000-0x0000020E41796000-memory.dmp	vmprotect
behavioral2/memory/4780-81-0x0000020E41490000-0x0000020E41796000-memory.dmp	vmprotect
behavioral2/files/0x000700000000068d-103.dat	vmprotect
behavioral2/memory/4616-195-0x0000000000E00000-0x0000000000F07000-memory.dmp	vmprotect

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\6JFZgAQC.cat	replace.exe
File created	C:\Windows\system32\ \Windows\System32\ikxK1AJ.sys	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0C4C.cat	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0C7C.cat	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0CD9.cat	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0D09.cat	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0C1F.cat	replace.exe
File opened for modification	C:\Windows\system32\jRCYj9DXwfs.sys	replace.exe
File opened for modification	C:\Windows\system32\KSDMA0fQ3XBb.xyp	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0CAC.cat	replace.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0D36.cat	replace.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\s9KGdRTPaYcug.sys	replace.exe
File opened for modification	C:\Program Files\WindowsPowerShell\manifest.json	replace.exe
File opened for modification	C:\Program Files\WindowsPowerShell\3966d8dc.js	replace.exe
File opened for modification	C:\Program Files\WindowsPowerShell\lib\6473fb81.js	replace.exe
File opened for modification	C:\Program Files (x86)\HzVR0H5Bhf.koe	replace.exe
File opened for modification	C:\Program Files\WindowsPowerShell\47c08f13.html	replace.exe
File opened for modification	C:\Program Files\WindowsPowerShell\561a454a.js	replace.exe
File opened for modification	C:\Program Files\hPAGhJQbE6LZ9p.sys	replace.exe
File opened for modification	C:\Program Files\zihdtzOerTCY1.ohl	replace.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\e85rduMpXq4U.sys	replace.exe
File opened for modification	C:\Windows\BdLfSVv8Wm.uyv	replace.exe
File created	C:\Windows\C6C3wD.sys	replace.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	replace.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	replace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	replace.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4728	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	replace.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	replace.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	replace.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	replace.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	replace.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	replace.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	replace.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	replace.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	replace.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
3124	Explorer.EXE
3124	Explorer.EXE
3124	Explorer.EXE
3124	Explorer.EXE
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe
4780	replace.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3124	Explorer.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Token: SeTcbPrivilege	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Token: SeDebugPrivilege	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
Token: SeDebugPrivilege	3124	Explorer.EXE
Token: SeDebugPrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeDebugPrivilege	4780	replace.exe
Token: SeDebugPrivilege	4780	replace.exe
Token: SeDebugPrivilege	4780	replace.exe
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3124	Explorer.EXE

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3124	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe	53
PID 4616 wrote to memory of 3124	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe	53
PID 4616 wrote to memory of 3124	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe	53
PID 3124 wrote to memory of 4780	3124	Explorer.EXE	79
PID 3124 wrote to memory of 4780	3124	Explorer.EXE	79
PID 3124 wrote to memory of 4780	3124	Explorer.EXE	79
PID 3124 wrote to memory of 4780	3124	Explorer.EXE	79
PID 3124 wrote to memory of 2600	3124	Explorer.EXE
PID 3124 wrote to memory of 664	3124	Explorer.EXE
PID 3124 wrote to memory of 1692	3124	Explorer.EXE
PID 4780 wrote to memory of 608	4780	replace.exe	85
PID 4780 wrote to memory of 608	4780	replace.exe	85
PID 4780 wrote to memory of 608	4780	replace.exe	85
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 4780 wrote to memory of 3124	4780	replace.exe	53
PID 3124 wrote to memory of 1192	3124	Explorer.EXE
PID 3124 wrote to memory of 4856	3124	Explorer.EXE
PID 3124 wrote to memory of 4852	3124	Explorer.EXE
PID 3124 wrote to memory of 1748	3124	Explorer.EXE
PID 3124 wrote to memory of 4360	3124	Explorer.EXE
PID 3124 wrote to memory of 3272	3124	Explorer.EXE
PID 3124 wrote to memory of 5116	3124	Explorer.EXE
PID 3124 wrote to memory of 4472	3124	Explorer.EXE
PID 3124 wrote to memory of 4936	3124	Explorer.EXE
PID 3124 wrote to memory of 5020	3124	Explorer.EXE
PID 3124 wrote to memory of 4188	3124	Explorer.EXE
PID 3124 wrote to memory of 988	3124	Explorer.EXE
PID 3124 wrote to memory of 3292	3124	Explorer.EXE
PID 3124 wrote to memory of 4904	3124	Explorer.EXE
PID 3124 wrote to memory of 3280	3124	Explorer.EXE
PID 3124 wrote to memory of 4104	3124	Explorer.EXE
PID 4616 wrote to memory of 3156	4616	2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe	102
PID 3156 wrote to memory of 4728	3156	cmd.exe	104

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\replace.exe
  "C:\replace.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\TpmInit.exe
    "C:\Windows\system32\TpmInit.exe"
    3⤵
    PID:608

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\2026-05-03_888c150d1073d3a4cbf497d688e591b7_amadey_elex_glassworm_hellokitty_remcos_stop.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2B0D0C7C.cat

Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D0C7C.cat
Size 5KB
SHA256 494280628758aaad9ca11c5843af59d3292d8680151ea8302fd9c1db612006b2
MD5 14abf2b885340e7205a4a6e5ce993c9a
SHA1 7d14cf5d84075cdf87315a60902bc910a0db8fbf
SHA512 ac802361b3b467944437688be21211f2c1946cab12d66467c74359a07b33d9a9fda54776d2a11fa799ab3e498c80a3354883e3386717a52e85e56401fd629d24
SSDEEP 96:dyDmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOG1:DIrXL0UIRIzw3jtlAur9ZCspE+TMQrO8
TLSH
T1B4B1C6D709082456EC865B91D5C6D66FED3467A52EC861A680B291992EC3BF07B0E80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e85rduMpXq4U.sys

Path C:\Windows\e85rduMpXq4U.sys
Size 171KB
SHA256 7860ba948f5df7266d40724ac9dd430afe36b7462eb41a96871116b01141d3d3
MD5 696d4e10f25431a27ed9c92ff514e5e5
SHA1 116d9aa544743ccfddddd3af42c3f95e17980ed4
SHA512 be90281b054c4eb2d7c1a0cf15a86b34b03b54de3d17352ffd0bb776abf1dcbc0687ab9aa5b86b9af92aca98264d7982f9d84201ed21a4109ebdf63406029a18
SSDEEP 3072:a+IaIfIEHlbySWsjhWDodnRlzYVucprnuRbW6kR/eKPkW79imuWgDSgpLIgWy:7INg4bYsjKodR567prnQW6u/e2Zidl
TLSH
T1810412C290D891F3D50C54BCBA5351E882E8307BE921C369F9443FBDBC5519AED42ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

replace.exe

Path C:\replace.exe
Size 40KB
SHA256 eb7487c0229b7ddf4b1c29312e5ddfce90d71836b3a1e73acd1aec0ffee301f7
MD5 c429130cfdb28edd418fd4c80434299f
SHA1 ba9ce9fe8c55c68393f261c1f49a52c5463c17dc
SHA512 bad2de5fdb4f0b9d2d77c43477a00808b09fcb05127fc4a266866e0d8e543fe8ac7e9aa7da4bede9e909cafa5c1c48baf586994c7d5e0c66fc42c6e425d73d32
SSDEEP 384:aPqTz3ULYzloMqsGRegTWpF56L1m9Acd/1YdYqxn7ptW1h/W:aPqULYzlo+Ggzwm2cd/1YdY4pE
TLSH
T1CA03D60C93B635E6E426C27CC0A50101C4BA7131671B6BFF2AE6C53A4F532D6ED38DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3124-45-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/3124-153-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/3124-16-0x00000000012F0000-0x00000000012F3000-memory.dmp

Download

memory/3124-152-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/3124-18-0x00000000012F0000-0x00000000012F3000-memory.dmp

Download

memory/3124-19-0x0000000005C50000-0x0000000005EE5000-memory.dmp

Download

memory/3124-21-0x0000000005C50000-0x0000000005EE5000-memory.dmp

Download

memory/3124-164-0x00000000046F0000-0x00000000046F1000-memory.dmp

Download

memory/3124-26-0x00000000012F0000-0x00000000012F3000-memory.dmp

Download

memory/3124-160-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/3124-154-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/3124-167-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/3124-166-0x0000000004710000-0x0000000004711000-memory.dmp

Download

memory/3124-163-0x00000000046E0000-0x00000000046E1000-memory.dmp

Download

memory/3124-44-0x0000000005C50000-0x0000000005EE5000-memory.dmp

Download

memory/3124-89-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/3124-155-0x0000000003370000-0x0000000003371000-memory.dmp

Download

memory/3124-156-0x0000000003380000-0x0000000003381000-memory.dmp

Download

memory/3124-165-0x0000000004700000-0x0000000004701000-memory.dmp

Download

memory/3124-55-0x00000000033C0000-0x00000000033C1000-memory.dmp

Download

memory/3124-53-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/3124-54-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/3124-157-0x0000000003390000-0x0000000003391000-memory.dmp

Download

memory/3124-158-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3124-159-0x00000000033B0000-0x00000000033B1000-memory.dmp

Download

memory/3124-161-0x00000000046C0000-0x00000000046C1000-memory.dmp

Download

memory/3124-162-0x00000000046D0000-0x00000000046D1000-memory.dmp

Download

memory/4616-194-0x0000000003950000-0x0000000003A9D000-memory.dmp

Download

memory/4616-15-0x0000000000E00000-0x0000000000F07000-memory.dmp

Download

memory/4616-0-0x0000000000E00000-0x0000000000F07000-memory.dmp

Download

memory/4616-193-0x0000000003950000-0x0000000003A9D000-memory.dmp

Download

memory/4616-195-0x0000000000E00000-0x0000000000F07000-memory.dmp

Download

memory/4616-14-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/4616-17-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/4616-13-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/4616-1-0x0000000000E00000-0x0000000000F07000-memory.dmp

Download

memory/4780-43-0x0000020E3D460000-0x0000020E3D461000-memory.dmp

Download

memory/4780-85-0x0000020E3D770000-0x0000020E3D771000-memory.dmp

Download

memory/4780-86-0x0000020E3D780000-0x0000020E3D7BF000-memory.dmp

Download

memory/4780-81-0x0000020E41490000-0x0000020E41796000-memory.dmp

Download

memory/4780-79-0x0000020E41490000-0x0000020E41796000-memory.dmp

Download

memory/4780-78-0x0000020E40D80000-0x0000020E40F5B000-memory.dmp

Download

memory/4780-72-0x0000020E40D80000-0x0000020E40F5B000-memory.dmp

Download

memory/4780-71-0x0000020E40D80000-0x0000020E40F5B000-memory.dmp

Download

memory/4780-69-0x0000020E3D770000-0x0000020E3D771000-memory.dmp

Download

memory/4780-68-0x0000020E3D780000-0x0000020E3D7BF000-memory.dmp

Download

memory/4780-66-0x0000020E3D780000-0x0000020E3D781000-memory.dmp

Download

memory/4780-67-0x0000020E3D770000-0x0000020E3D771000-memory.dmp

Download

memory/4780-65-0x0000020E3D780000-0x0000020E3D781000-memory.dmp

Download

memory/4780-64-0x0000020E3D780000-0x0000020E3D781000-memory.dmp

Download

memory/4780-63-0x0000020E3D770000-0x0000020E3D771000-memory.dmp

Download

memory/4780-62-0x0000020E3D780000-0x0000020E3D781000-memory.dmp

Download

memory/4780-61-0x0000020E3D770000-0x0000020E3D771000-memory.dmp

Download

memory/4780-59-0x0000020E3D710000-0x0000020E3D711000-memory.dmp

Download

memory/4780-52-0x0000020E3D710000-0x0000020E3D711000-memory.dmp

Download

memory/4780-51-0x00007FFFA2C90000-0x00007FFFA2CA0000-memory.dmp

Download

memory/4780-46-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp

Download

memory/4780-41-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp

Download

memory/4780-42-0x00007FFFA2C90000-0x00007FFFA2CA0000-memory.dmp

Download

memory/4780-38-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp

Download

memory/4780-31-0x0000020E3D7E0000-0x0000020E3DA47000-memory.dmp

Download