Overview

overview

10

Static

static

10

2026-06-28...ar.exe

windows10-2004-x64

8

2026-06-28...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    118s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 22:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
  • Size 3.7MB
  • Sample260628-18v8hsft2v
  • SHA256 e417460b48b8b1e3f3c40dbdcfe18f6221a5585806b433f2500e79e51eddc2bf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3332
      • C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\ScreenConnect.WindowsClient.exe
        "C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\ScreenConnect.WindowsClient.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:3592
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1436
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4796
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5232

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442.cdf-ms
        • Size 14KB
        • SHA256 8a9c85af4b5bd11949ef5f6f46ea02bf136d8f6467d443a2b68684bdff8f462a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d.cdf-ms
        • Size 3KB
        • SHA256 f5d26d2ed5762b73f33b23b8399d239abd056d67591713fa0c76cc7834eaa2d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d.cdf-ms
        • Size 5KB
        • SHA256 b82ee2da336c77e311a6bf9345a682c38951e1abb911ea8a443814d27d27f1f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a.cdf-ms
        • Size 6KB
        • SHA256 5876504670b522261661e2bba04fa6daec8d5533180cf001ac8438a13894e3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131.cdf-ms
        • Size 2KB
        • SHA256 d2072588633db4e083046e4d16f6fe6e217f1fb6e3968552521ef6ca4489c17a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f.cdf-ms
        • Size 4KB
        • SHA256 815d9ef87af7fe2b85a32ede5401b24e7abde9189c7145487809e8d8682dac5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\PZRXJZLE.JKB\GK5YMRV2.5HH\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98.cdf-ms
        • Size 4KB
        • SHA256 a3fe6d7c8b48644cc6d0933600c74ebb993f39f678566e10f67844438dadbecc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.Client.dll
        • Size 631KB
        • SHA256 3d1a0640eba8589ccbf85665b9b785daa3846ea4d68f5be3bc652d939661752f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.Client.dll.genman
        • Size 1KB
        • SHA256 5ced1c162b04ebfd3c02f1da7cd9745397c64a8fcc129577e5b7057e3b203b87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.ClientService.dll
        • Size 183KB
        • SHA256 b5f87442f0e3914a14ed47727adf078548aa90801c27ca948a23111080b61d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.ClientService.dll.genman
        • Size 1KB
        • SHA256 8fa5969ebfeaa633f480ab3e86f51bb83ea23e779daaa7004f7c1f8565f4ff97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 f603cf8fe05911f40778cf7bf9225b8967383b0f693014399074a50743a6a0cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.Core.dll
        • Size 1.3MB
        • SHA256 55c4eb24d332b4b7a1151481ec45e560045f0f8d4d4452c62fe82cd982b4d5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.Core.dll.genman
        • Size 1KB
        • SHA256 c7daae6b34b0c1727e757dfb293f767ee3d8eebd062a3b5906b555b215ccf402
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.Windows.dll
        • Size 1.9MB
        • SHA256 4156c38f37d80a676438d9e419ebc835bcffd40625f160ab40df3b800c8c35e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.Windows.dll.genman
        • Size 1KB
        • SHA256 74a763d51639e87b910148dcdb95dd9ea6f0c45c8338b1e4c529d91948883492
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsBackstageShell.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.WindowsBackstageShell.exe
        • Size 137KB
        • SHA256 ae78d3c99eb77618d73cb533d3123cf714f6ed383332d6cf039992c798f9819f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.WindowsClient.exe
        • Size 1.5MB
        • SHA256 4cc8e2e708a2a3a4e7e385861ea1e20ff0ca674ba8829579d0a5ea255c76aa13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.WindowsClient.exe.genman
        • Size 2KB
        • SHA256 8f854476419cddfaec5635f8c527f64ee0972f1375f5487bbcf4913f7bb2a2cb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.WindowsClient.exe.manifest
        • Size 7KB
        • SHA256 8f1a7c857af7cc3718e7fe14b0ad0c785a3f96a9235ded727aa9caee1ba1cbb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsFileManager.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\2B19EL5A.AAB\PX0L8PMW.HH0\ScreenConnect.WindowsFileManager.exe
        • Size 118KB
        • SHA256 fd62d5929fae7835e8e9a70ff364fae4668abe06d0fcffee6dc917373edbc227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D9W7C7AK.TPB.application
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\TYCRRX16.MXZ\D9W7C7AK.TPB.application
        • Size 107KB
        • SHA256 cdc9c99ebd4253b95ce6c9fdc2db03455ba3692f871187a08286ef473f93546f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1436-487-0x000000000D470000-0x000000000D53C000-memory.dmp
        Download

        memory/1436-486-0x000000000F570000-0x000000000F6DC000-memory.dmp
        Download

        memory/2740-11-0x0000000074982000-0x0000000074983000-memory.dmp
        Download

        memory/2740-4-0x0000000005670000-0x00000000057BA000-memory.dmp
        Download

        memory/2740-10-0x00000000061B0000-0x0000000006394000-memory.dmp
        Download

        memory/2740-8-0x0000000005F40000-0x0000000005FD2000-memory.dmp
        Download

        memory/2740-5-0x0000000005B40000-0x0000000005BAE000-memory.dmp
        Download

        memory/2740-7-0x0000000006400000-0x00000000069BA000-memory.dmp
        Download

        memory/2740-6-0x0000000074970000-0x000000007512C000-memory.dmp
        Download

        memory/2740-9-0x0000000074970000-0x000000007512C000-memory.dmp
        Download

        memory/2740-0-0x0000000074982000-0x0000000074983000-memory.dmp
        Download

        memory/2740-3-0x0000000074970000-0x000000007512C000-memory.dmp
        Download

        memory/2740-17-0x0000000074970000-0x000000007512C000-memory.dmp
        Download

        memory/2740-12-0x0000000074970000-0x000000007512C000-memory.dmp
        Download

        memory/2740-2-0x00000000016E0000-0x00000000016EE000-memory.dmp
        Download

        memory/2740-1-0x0000000000F70000-0x0000000000F78000-memory.dmp
        Download

        memory/3332-14-0x00007FFA8462F000-0x00007FFA84630000-memory.dmp
        Download

        memory/3332-19-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-60-0x000001F7E3250000-0x000001F7E32F2000-memory.dmp
        Download

        memory/3332-54-0x000001F7E34C0000-0x000001F7E3646000-memory.dmp
        Download

        memory/3332-48-0x000001F7E3440000-0x000001F7E358A000-memory.dmp
        Download

        memory/3332-42-0x000001F7E2F50000-0x000001F7E2F82000-memory.dmp
        Download

        memory/3332-32-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-31-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-30-0x000001F7E30B0000-0x000001F7E3100000-memory.dmp
        Download

        memory/3332-21-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-20-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-66-0x000001F7E3570000-0x000001F7E3754000-memory.dmp
        Download

        memory/3332-18-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-13-0x000001F7C4020000-0x000001F7C4028000-memory.dmp
        Download

        memory/3332-15-0x000001F7DE800000-0x000001F7DE988000-memory.dmp
        Download

        memory/3332-298-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3332-16-0x00007FFA844A0000-0x00007FFA84E44000-memory.dmp
        Download

        memory/3592-297-0x0000000002E10000-0x0000000002E42000-memory.dmp
        Download

        memory/3592-284-0x0000000000A00000-0x0000000000B86000-memory.dmp
        Download

        memory/4796-312-0x000001EA86960000-0x000001EA86980000-memory.dmp
        Download

        memory/4796-346-0x000001EA96F30000-0x000001EA96F50000-memory.dmp
        Download

        memory/4796-313-0x000001EA96BC0000-0x000001EA96CC0000-memory.dmp
        Download

        memory/4796-323-0x000001EA86AA0000-0x000001EA86AC0000-memory.dmp
        Download

        memory/4796-302-0x000001EA82EA0000-0x000001EA82FA0000-memory.dmp
        Download