cd90f40e7145f87cf512a09ddd001e2b1c50c594daed9d95a2679446fd2c7f48

Analysis

max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe
Size 1.9MB
Sample260529-pc89qabs3w
SHA256 cd90f40e7145f87cf512a09ddd001e2b1c50c594daed9d95a2679446fd2c7f48
MD5 d704dbf0f650712d9af93b3049632f85
SHA1 2e5e5b189bc0a3335b22e1afd45c28bd57f3c194
SHA512 125f32d6538797153a796e039f0df2c697dfcd7ff7e072435b4ca1d0496a5082a79887dfce3fa3f7d8eb740b930472b2d0bc92718c0d8b6151294a55db178a7b
SSDEEP 49152:+WpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNFih:JQBiZ5s5IDepwM1y/AIqNVw45Jih
TLSH
T131959D1276E5D036F5B312319DB992289976BCA18A39849FB3DC171E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3572	2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3572	2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe
3572	2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3572	3052	2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\jds240647625.tmp\2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240647625.tmp\2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240647625.tmp\2026-05-29_d704dbf0f650712d9af93b3049632f85_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee.exe
Size 1.6MB
SHA256 394ad6212e4866cc8e6d1834df8f70538dddf09d23dfa65ea204b22c012b541a
MD5 109cbe148f827137c3ba62261f01b29b
SHA1 2cc02b09da46d9e5d0ac1b306a0bbcc12bfe4c12
SHA512 a2dfa03dd290540bcfeda6cfd7d6ed891700742b4323d8c8dbfc4c822386ef1ddfff5cf71b2e5d7be9ec72fb6fc2145ff6ffc440823187d6956d5aa2794c5799
SSDEEP 49152:VxmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNJ:VQBiZ5s5IDepwM1y/AIqNVw45F
TLSH
T179758D1277E59135F5B313319D7992285576B8A28A3984EFB3DD021E8F70AD18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 907285d47f2c65bfb7374d662ea95c3618ff160a71546241ee465d36beeed4bb
MD5 b94c7fe7ae0021de9c68a7b0e3162d1a
SHA1 35dfef3997c908e94c25f02c1178f8bec0913d5e
SHA512 e4663f91326ce018b0702edbfd11911ce945d23982caa33a9f0fdd671ec02c3122f6419c52a64989f49f268524d8846209e8eda15338681e991f5fb5bc1397ec
SSDEEP 3072:e87ZchxJracfsrCxUm1FIDQ6XU6xxnfoA1tam/iTq4/:l3Yd
TLSH
T17DF31246C92E84BA35538BD3C37A5D64D692162E839E891831CFC2EFB446D03D52E4EF
MD5 SHA1 SHA512 SSDEEP TLSH