90458a17e3e672d03a142a00e1af0ace3edb162e9d84e346d9131f9d24e65917

Analysis

max time kernel
150s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
Size 2.0MB
Sample260522-d2dzbsdv2q
SHA256 90458a17e3e672d03a142a00e1af0ace3edb162e9d84e346d9131f9d24e65917
MD5 28f97ee15e9ce9634e20f6991d9c9982
SHA1 8b0da0b277080acb5dc6c34f7b5024fab332e566
SHA512 b4c601b55e7e242e034f02430e93ba6c2b37c2f6c3db9adfa2c92e0d7ca52368846f75b0ce522d8239ed321cbc53dbcf4911175a03dab5eb6901b74b1443bb46
SSDEEP 24576:PSH25PwcN2jx23LdZNtWFKVJIdaY5VFt1LuqJhDqGFeyUQPurCD8JYjSK5ECX:PlDoOTNtGKfIvfuRVy/Pur2MgX
TLSH
T1AEA5AE12F6D380F6D715053004BB6B3AEA359A460B25DBC3B39CDD6C7F33661A52632A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360tray.lnk	ippatch.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IP.lnk	ipsee.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IP.lnk	ipsee.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360tray.lnk	ippatch.exe

Executes dropped EXE 3 IoCs

pid	Process
4628	ippatch.exe
1428	ipsee.exe
2444	ippatch.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ippatch.exe
File opened for modification	\??\PhysicalDrive0	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
File opened for modification	\??\PhysicalDrive0	ippatch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ippatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ippatch.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
1972	taskkill.exe
1432	taskkill.exe
1860	taskkill.exe
1516	taskkill.exe
1080	taskkill.exe
2036	taskkill.exe
4732	taskkill.exe
2700	taskkill.exe
3976	taskkill.exe
2368	taskkill.exe
3064	taskkill.exe
1416	taskkill.exe
4992	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
1428	ipsee.exe
1428	ipsee.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
1428	ipsee.exe
1428	ipsee.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
1428	ipsee.exe
1428	ipsee.exe
1428	ipsee.exe
1428	ipsee.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe
4628	ippatch.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	1860	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
4628	ippatch.exe
4628	ippatch.exe
1428	ipsee.exe
1428	ipsee.exe
2444	ippatch.exe
2444	ippatch.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2700	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	80
PID 1196 wrote to memory of 3976	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	81
PID 1196 wrote to memory of 4628	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	85
PID 4628 wrote to memory of 1860	4628	ippatch.exe	86
PID 4628 wrote to memory of 1428	4628	ippatch.exe	88
PID 1196 wrote to memory of 2444	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	89
PID 1196 wrote to memory of 1516	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	90
PID 1196 wrote to memory of 2368	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	91
PID 1196 wrote to memory of 3064	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	94
PID 1196 wrote to memory of 1416	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	95
PID 1196 wrote to memory of 4992	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	98
PID 1196 wrote to memory of 1972	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	99
PID 1196 wrote to memory of 1432	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	102
PID 1196 wrote to memory of 1080	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	103
PID 1196 wrote to memory of 2036	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	106
PID 1196 wrote to memory of 4732	1196	2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_28f97ee15e9ce9634e20f6991d9c9982_elex_emotet_glassworm_hacktools_icedid_remcos.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im ippatch.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im ipsee.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Users\Admin\AppData\Roaming\ippatch.exe
  "C:\Users\Admin\AppData\Roaming\ippatch.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ipsee.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Users\Admin\AppData\Roaming\ipsee.exe
    "C:\Users\Admin\AppData\Roaming\ipsee.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1428
- C:\Users\Admin\AppData\Roaming\ippatch.exe
  "C:\Users\Admin\AppData\Roaming\ippatch.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2368
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1416
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1972
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1080
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

360tray.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360tray.lnk
Size 771B
SHA256 c515c356b84ea9e18b6f1fca5877a6359596771cdf4d6aabdd8dee4b53a8becf
MD5 ebbe682fa3d53024c963ba31f2c9b580
SHA1 6459da246dbfeb7a586913b4a0bb56ca8eeb331c
SHA512 31e1340cde4fc55d9b2f74683485c009d84fe5d336e025b53b4452d226e0a3e82c3f3c262f9de2c1673ddf81fa62ec321f270dc3cffcbc87ed34968b7a93f114
TLSH
T16C012396A5D20F21D1E2427007BB6330BF3AF5C6F7C1630C4945034D6A6DF015918D1B
MD5 SHA1 SHA512 TLSH

Submit Download

yhxx.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\yhxx.dll
Size 154B
SHA256 c551be73cdf086d8b11a4b92910c939cec35e1a8805ee3099b18c5a26f14aff3
MD5 40b80bda339faae4739d77caa3ebd0eb
SHA1 54e11813769d714dbf3153ec6f2620b919a00fca
SHA512 ab087ef1fb1a60772dcd091dc45a47d5b3f5f17f3aa6ae0f1293983b4015a7b1217e69bea95d6f3e4085962f8ef3ca3f529e76d083ab805648aa1bb76480e376
TLSH
T1FAC08C4C862139866FE863D22A2EE25488A3045128D102DCC206CC0A40C0B306CA0330
MD5 SHA1 SHA512 TLSH

Submit Download

RCX4498.tmp

Path C:\Users\Admin\AppData\Roaming\RCX4498.tmp
Size 2.0MB
SHA256 f20efdbdf1a0fe851288985e95a21785aca0f08c29e6a8049d3d22a617b47dda
MD5 8550cee5b0c44a9734b0dc31aa938aad
SHA1 d34edf8ea8ed51f7dc038feb56544c6c653d31ea
SHA512 ff6fbec20e54c70fc3a33bc2042a4ef89b5d89204dc9f39760bfa9975794cb000ce8c29ccff8ec756f427ab24ce2ee56b551062587540c28087ca55804ada313
SSDEEP 24576:PSH25PwcN2jx23LdZNtWFKV7IdaY5VFt1LuqJhDqGFeyUQPurCD8JYjSK5ECX:PlDoOTNtGKBIvfuRVy/Pur2MgX
TLSH
T14EA5AE12F6D380F6D715053004BB6B3AEA359A460B25DBC3B39CDD6C7F33661A52632A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipsee.exe

Path C:\Users\Admin\AppData\Roaming\ipsee.exe
Size 868KB
SHA256 b2525b96d3331b670ce903c0329faafb74e6b563021ac065c93dfb00f26bf606
MD5 33f5b967107444ec654b386017c01e6c
SHA1 a2b24e077c09cf799c399d76ab6f49fde423a092
SHA512 4999d74bbc092f5868b587ff57f962b17cacc5dd612a434c5e0b7abbc7f32bdcacf802166eb725b50ebcd134abecf9d16eca5ae89a2c0ce930a7a750f2e83dfa
SSDEEP 12288:mFt1+YJ2VYMHq8GhDFQGFNrIyUNWPuLjZpzbf3yD8Jkjpy:mFt1LuqJhDqGFeyUQPurCD8Jkj0
TLSH
T15D158E13B6A291F5C204057019BF7737E6759B4A0A35CBC7A398DD2C7E332A0B626379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\mydll.dll
Size 256KB
SHA256 279409063e462af909d12f02a39c6a1aea1b723a561395b9c6a967c404a26371
MD5 736f3a227de02daefcd4e51c19b74b6b
SHA1 f88c31c4e55ed3fac0a551abb98ff36c6ccf16b8
SHA512 2e838077357f3a7dd56eb1b6733cead34eec8823f898d4bb284d49086381ad6b850a2cdf6d6cb55a5860ff17764152ee8d25e343db1aaca44f443ea97dcca087
SSDEEP 3072:Njxa3yvpDmpclpYDXe195VgL8GZXoql7QtNurY9bvYYZ:Nla3yRD7Y7ePLgL5Pl6vx
TLSH
T1FC449E0238D3807BD34F023C46A21BB65BFED512DFA39A9BD740CE5C5E726258936276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\mydll.dll
Size 256KB
SHA256 f369e62745e743b2d59b96b13b5de91f0f7ee1bff34aa44e36ebdbca75491275
MD5 662e2e6648b153c95c0b8990471db2e7
SHA1 8af9cda2b4128016483a44a8f12c8a52dc55abc5
SHA512 0fb98a5f50e8a87fe144d08962537a8bae2f428487ab695e3120d0a46fca290a85243bb0ffcd780a3164e498e8fefeb18580aa3f977a2f07412d3628eb1cb397
SSDEEP 3072:Njxa3yvpDmpclpYDXe195VgL8GZXoql7QtNuUY9bvYYZ:Nla3yRD7Y7ePLgL5P+6vx
TLSH
T138449F023893807BD34F023D06A21B765BFED512DFB39A9BD744CE5C5E7262189362B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\mydll.dll
Size 256KB
SHA256 7cc96f9ba036fcb7e2c19a629be2f87812b0a7459ab9cd4aac6ec6dcd8050ce0
MD5 7a0ce0e7b19e8826c6834b341440a25b
SHA1 9e8a979535bee558eac192a5e48215c2eb8ca79b
SHA512 17f170e655e99b9fe463839cc5e7fb851d09f315a5fded3ddc377ea0d002d931db00a83f19786473c40f5acf9bdc089b435eb90eb93254201f114bdd22b82fbc
SSDEEP 3072:Njxa3yvpDmpclpYDXe195VgL8GZXoql7QtNuXY9bvYYZ:Nla3yRD7Y7ePLgL5Pl6vx
TLSH
T1D0449E023893807BD34F023C06911B766BFE9512DFB68A9BD740CE9C5E727258D262B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download