Analysis
- max time kernel
150s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 02:29
Behavioral task
behavioral1
Sample
2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 4.5MB
- Sample260523-cyqchsdy21
- SHA256 6d77deb3fd904c1e9bdcdac0afda228fcf0cbe9046bbe130cb1724831f8b9d37
- MD5 b3c3bb4ed25e04bb3185a5759fbab7cf
- SHA1 23248bf480a279dca6f27a193ff559289638f79e
- SHA512 8f1923d3c9dcb2da623016ec94024db5f614ee2c098c1128fe66615c46c24d1e2681021ec58c787616d575fcdd37862ca14acccd799ece11cc2380d0b08049a9
- SSDEEP 98304:8exgmHwKIcYJ1N7Lm04ptI563bFnHrrrrrq:vHbwN2xc635nHrrrrrq
- TLSH T1A626AE56B6A185B1C46BC1388DEB461AE772BC010B22CBCB6394772E6F333D15E3A751
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables packed with VMProtect. 11 IoCs
resource yara_rule behavioral2/memory/616-0-0x0000000000C10000-0x0000000000D18000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/616-1-0x0000000000C10000-0x0000000000D18000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/616-7-0x0000000000C10000-0x0000000000D18000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3292-24-0x000000000EAE0000-0x000000000ED86000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3292-25-0x000000000EAE0000-0x000000000ED86000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5668-36-0x0000022C95AF0000-0x0000022C95D6C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5668-39-0x0000022C95AF0000-0x0000022C95D6C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5668-47-0x0000022C95AF0000-0x0000022C95D6C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5668-40-0x0000022C95AF0000-0x0000022C95D6C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3292-60-0x000000000EAE0000-0x000000000ED86000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5668-62-0x0000022C95AF0000-0x0000022C95D6C000-memory.dmp INDICATOR_EXE_Packed_VMProtect - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\oO0cCgb.sys recover.exe - Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146944" recover.exe - Executes dropped EXE 1 IoCs
pid Process 5668 recover.exe - Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5668 recover.exe -
resource yara_rule behavioral2/memory/616-0-0x0000000000C10000-0x0000000000D18000-memory.dmp vmprotect behavioral2/memory/616-1-0x0000000000C10000-0x0000000000D18000-memory.dmp vmprotect behavioral2/memory/616-7-0x0000000000C10000-0x0000000000D18000-memory.dmp vmprotect behavioral2/memory/3292-24-0x000000000EAE0000-0x000000000ED86000-memory.dmp vmprotect behavioral2/memory/3292-25-0x000000000EAE0000-0x000000000ED86000-memory.dmp vmprotect behavioral2/memory/3292-60-0x000000000EAE0000-0x000000000ED86000-memory.dmp vmprotect - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\OrmXLWQXN.cat recover.exe File created C:\Windows\system32\ \Windows\System32\dBa7hk8K.sys recover.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\A1bUd9.sys recover.exe File created C:\Windows\Fonts\recover.exe Explorer.EXE File opened for modification C:\Windows\Fonts\recover.exe Explorer.EXE - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 recover.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName recover.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 recover.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\New Windows\Allow recover.exe Set value (data) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.hao774.com recover.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 3292 Explorer.EXE 3292 Explorer.EXE 3292 Explorer.EXE 3292 Explorer.EXE 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe 5668 recover.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3292 Explorer.EXE - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 680 Process not Found 680 Process not Found 680 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeTcbPrivilege 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeDebugPrivilege 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeDebugPrivilege 3292 Explorer.EXE Token: SeDebugPrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeDebugPrivilege 5668 recover.exe Token: SeDebugPrivilege 5668 recover.exe Token: SeDebugPrivilege 5668 recover.exe Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeDebugPrivilege 5668 recover.exe Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 616 wrote to memory of 3292 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 54 PID 616 wrote to memory of 3292 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 54 PID 616 wrote to memory of 3292 616 2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 54 PID 3292 wrote to memory of 5668 3292 Explorer.EXE 80 PID 3292 wrote to memory of 5668 3292 Explorer.EXE 80 PID 3292 wrote to memory of 5668 3292 Explorer.EXE 80 PID 3292 wrote to memory of 5668 3292 Explorer.EXE 80 PID 3292 wrote to memory of 5940 3292 Explorer.EXE PID 3292 wrote to memory of 4940 3292 Explorer.EXE PID 3292 wrote to memory of 3548 3292 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_b3c3bb4ed25e04bb3185a5759fbab7cf_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
-
-
C:\Windows\Fonts\recover.exe"C:\Windows\Fonts\recover.exe"2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5668
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Fonts\recover.exe
- Size 36KB
- SHA256 56ce9555153058218b159c7b0bb4b41f57e65f501871f5466e653b5edd9df804
- MD5 65554e32a661d41fbb9fd2b8f8749af2
- SHA1 47fb81cc690a80a0e70330d9b1115b1b997a3281
- SHA512 957bfd299e681eb10eb7f90d2147cb0968aa0a0527388eee6b18ccbe38d2bf491877800f35a0f95dee2a9cb5bd5dd766166a6646d8a9e61be8730a40fb99e2b8
- SSDEEP 192:d5jj+o/Wzi9jdt0etw2/EaD0f8UqY0tDNCSsm2DWbnW7:z+o/SiFdt0ejEaD9xJN2DWbnW
- TLSH T1ECF2A50C93B635D7F026827DC4A20050507A7631A3296EFF28D5E6328F936D9EE79F91
- MD5 SHA1 SHA512 SSDEEP TLSH