Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
09/05/2026, 03:52
General
- Target 2026-05-09_612247fa25a85aa532c5b572b520f105_elex_glassworm_rhadamanthys_stop.exe
- Size 827KB
- Sample260509-ee9cdsav2t
- SHA256 99e63f62b4d5ef6ef3006b87837d7d4d12abb9c0d4d12d4856e7e1290560ecf8
Malware Config
Signatures
- Custom signatureDetects executables packed with ConfuserEx Mod 4 IoCs
- Loads dropped DLL 2 IoCs
- ConfuserEx .NET packer 4 IoCs
Detects ConfuserEx .NET packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_612247fa25a85aa532c5b572b520f105_elex_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_612247fa25a85aa532c5b572b520f105_elex_glassworm_rhadamanthys_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kutED0.tmp
memory/1200-11-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/1200-13-0x0000000008B70000-0x0000000008BD6000-memory.dmp
memory/1200-6-0x0000000004C30000-0x0000000004C3A000-memory.dmp
memory/1200-7-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/1200-8-0x0000000005730000-0x0000000005CD4000-memory.dmp
memory/1200-9-0x0000000005220000-0x00000000052B2000-memory.dmp
memory/1200-10-0x0000000005200000-0x000000000520A000-memory.dmp
memory/1200-0-0x0000000000240000-0x0000000000310000-memory.dmp
memory/1200-5-0x0000000004CB0000-0x0000000004D38000-memory.dmp
memory/1200-22-0x000000000D550000-0x000000000DCF6000-memory.dmp
memory/1200-12-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/1200-23-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/1200-24-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/1200-25-0x0000000000D20000-0x0000000000EC0000-memory.dmp
memory/1200-26-0x00000000053D0000-0x000000000544E000-memory.dmp
memory/1200-27-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/1200-40-0x0000000000240000-0x0000000000310000-memory.dmp