Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
09/05/2026, 03:52
General
- Target 2026-05-09_612247fa25a85aa532c5b572b520f105_elex_glassworm_rhadamanthys_stop.exe
- Size 827KB
- Sample260509-ee9cdsav2t
- SHA256 99e63f62b4d5ef6ef3006b87837d7d4d12abb9c0d4d12d4856e7e1290560ecf8
Malware Config
Signatures
- Custom signatureDetects executables packed with ConfuserEx Mod 4 IoCs
- Loads dropped DLL 2 IoCs
- ConfuserEx .NET packer 4 IoCs
Detects ConfuserEx .NET packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_612247fa25a85aa532c5b572b520f105_elex_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_612247fa25a85aa532c5b572b520f105_elex_glassworm_rhadamanthys_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kut31AA.tmp
memory/5424-11-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5424-13-0x00000000094F0000-0x0000000009556000-memory.dmp
memory/5424-6-0x0000000005790000-0x000000000579A000-memory.dmp
memory/5424-7-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5424-8-0x00000000063E0000-0x0000000006986000-memory.dmp
memory/5424-9-0x0000000005D10000-0x0000000005DA2000-memory.dmp
memory/5424-5-0x00000000057E0000-0x0000000005868000-memory.dmp
memory/5424-10-0x0000000005DB0000-0x0000000005DBA000-memory.dmp
memory/5424-12-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5424-0-0x0000000000A20000-0x0000000000AF0000-memory.dmp
memory/5424-22-0x000000000DCB0000-0x000000000E456000-memory.dmp
memory/5424-23-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5424-24-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5424-25-0x0000000005E30000-0x0000000005EF1000-memory.dmp
memory/5424-26-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5424-33-0x0000000000A20000-0x0000000000AF0000-memory.dmp