Overview

overview

10

Static

static

10

2026-06-25...ar.exe

windows10-2004-x64

6

2026-06-25...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-25_4f7052d5c4046f4b3eac3686860634f6_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
  • Size 2.5MB
  • Sample260629-2eppbahy2k
  • SHA256 dc33398f485844daf651feaeec469adf56a4c91d99c922c90fb1a1ced04d75b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-25_4f7052d5c4046f4b3eac3686860634f6_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-25_4f7052d5c4046f4b3eac3686860634f6_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6056
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\scre..tion_0000000000000000_001a.0002_b51dce6f61e650cc\ScreenConnect.WindowsClient.exe
        "C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\scre..tion_0000000000000000_001a.0002_b51dce6f61e650cc\ScreenConnect.WindowsClient.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:1088
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3680
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4704
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5288

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1.cdf-ms
        • Size 14KB
        • SHA256 149cbfbc8f65d3832ac5cd7953d523f800015ab76f72df0bd15d59f6d0e6cbbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac.cdf-ms
        • Size 3KB
        • SHA256 620c9bc166786aecab09a105887f3b3ad26e97c905e8353c33e957fd10260eb0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc.cdf-ms
        • Size 5KB
        • SHA256 ca0abe87e2c0021c3f146d2ce2d1997f6ba923e3fbacb1fc93d0d925a4e2b9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9.cdf-ms
        • Size 6KB
        • SHA256 e52fd9dd509c4fd040c1920f390a6d11e7b8e2ba637829d8a09fd9bb0f9056b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0.cdf-ms
        • Size 2KB
        • SHA256 fe320cfee767d76989c11308cf1812740129ec9fc7b51a11178492c410a984b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe.cdf-ms
        • Size 4KB
        • SHA256 0150992d152d4a4f033c3c5421d419f772be49e36523bd4d65d9b1c696019565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\GW9BNGOM.TNP\K1NMOR17.EO5\manifests\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717.cdf-ms
        • Size 4KB
        • SHA256 04f5491c4f9bf992a626e7ef26532787148918b7a256a288f68398ac369484a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VE4JPP9L.JM1.application
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\DXATT2LJ.MG8\VE4JPP9L.JM1.application
        • Size 133KB
        • SHA256 359ee2c87c9ece977ad40e0e177e9f7e769e7c93779d1bee44fa047d02e9a398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.Client.dll
        • Size 412KB
        • SHA256 9ca0dd6d983eaa03fd43befb83fc297fa6a0f5ae46e6acfad422fdf7784cf575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.Client.dll.genman
        • Size 1KB
        • SHA256 7fdfc06a2b2bbd5964934b184da06c1af56dcf76940e97263e85e3917983fc24
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.ClientService.dll
        • Size 89KB
        • SHA256 36e211d86dd6883bd49e5554ea47f0ff4e0422e64d50d9acfead2ef3ea43ef3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.ClientService.dll.genman
        • Size 1KB
        • SHA256 8bd45c4e681529c90907b4bfeb76065ef8eb724efba4fe6ba8d2ee740861fd28
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 16d5596c5d53497ea722ae9713984de93478b53fdc8b34587b12656414967849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.Core.dll
        • Size 575KB
        • SHA256 4d16bdfd1b74808161f59a15f70746f8279208899644b0662bebe320dc8fbaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.Core.dll.genman
        • Size 1KB
        • SHA256 0f83bbabc956b819bc3aa4649f91f6d4f085fc5d1b4d89eb178c95428fea625f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 a0702217c7542d53a938003b89ade00e324814104c1a8fdf4f09338c5b624505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.Windows.dll.genman
        • Size 1KB
        • SHA256 f542400bf3815f405643e11131a9a9d04ccabc5cdd1a93b76aa6f2cbcdbfce43
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsBackstageShell.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.WindowsBackstageShell.exe
        • Size 71KB
        • SHA256 4aea3c1985c64acd63203bbbcc82df991e87e2f3fd9bfb27d66a8e1b1f4bb103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.WindowsClient.exe
        • Size 668KB
        • SHA256 9d0c96d6a286c64a97c60e83a85f6140db26a995d8a2fcd81d56c030bcf855ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.WindowsClient.exe.genman
        • Size 2KB
        • SHA256 d41ecc668fe228c67a42cfdcbf336d6fdb53cd6a1f6103c56ed11cd1b263784a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.WindowsClient.exe.manifest
        • Size 7KB
        • SHA256 422e3eab7aeffb1ea3a5e6996df1d75d907100d128eb040b0c6b65b2d5d790f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsFileManager.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y21BN44G.5WV\E769VRPE.YXP\ScreenConnect.WindowsFileManager.exe
        • Size 91KB
        • SHA256 66617969158867a0c983e7573c943ea61d20387b79b81674202a6669a314995f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1088-301-0x000000001B7B0000-0x000000001B7CA000-memory.dmp
        Download

        memory/1088-287-0x0000000000610000-0x00000000006BA000-memory.dmp
        Download

        memory/4200-16-0x0000023EEDFB0000-0x0000023EEE138000-memory.dmp
        Download

        memory/4200-22-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-45-0x0000023EF2930000-0x0000023EF2AE0000-memory.dmp
        Download

        memory/4200-35-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-33-0x0000023EF2340000-0x0000023EF2390000-memory.dmp
        Download

        memory/4200-51-0x0000023EEF4C0000-0x0000023EEF4DA000-memory.dmp
        Download

        memory/4200-57-0x0000023EF2730000-0x0000023EF27DA000-memory.dmp
        Download

        memory/4200-24-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-63-0x0000023EF2670000-0x0000023EF2704000-memory.dmp
        Download

        memory/4200-23-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-69-0x0000023EF25D0000-0x0000023EF263C000-memory.dmp
        Download

        memory/4200-302-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-34-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-21-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-19-0x00007FFD51F70000-0x00007FFD52914000-memory.dmp
        Download

        memory/4200-15-0x0000023ED3840000-0x0000023ED3848000-memory.dmp
        Download

        memory/4200-18-0x00007FFD520FF000-0x00007FFD52100000-memory.dmp
        Download

        memory/4704-313-0x0000029B82EB0000-0x0000029B82FB0000-memory.dmp
        Download

        memory/4704-312-0x0000029B82A00000-0x0000029B82A20000-memory.dmp
        Download

        memory/4704-345-0x0000029B941E0000-0x0000029B94200000-memory.dmp
        Download

        memory/4704-335-0x0000029B82DE0000-0x0000029B82E00000-memory.dmp
        Download

        memory/4704-304-0x0000029B801E0000-0x0000029B802E0000-memory.dmp
        Download

        memory/6056-14-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-10-0x0000000005A60000-0x0000000005C10000-memory.dmp
        Download

        memory/6056-9-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-8-0x00000000058D0000-0x0000000005962000-memory.dmp
        Download

        memory/6056-6-0x0000000005E90000-0x000000000644A000-memory.dmp
        Download

        memory/6056-7-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-5-0x0000000005770000-0x0000000005798000-memory.dmp
        Download

        memory/6056-3-0x00000000056E0000-0x0000000005774000-memory.dmp
        Download

        memory/6056-4-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-2-0x00000000030F0000-0x00000000030FC000-memory.dmp
        Download

        memory/6056-11-0x0000000075032000-0x0000000075033000-memory.dmp
        Download

        memory/6056-12-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-13-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-0-0x0000000075032000-0x0000000075033000-memory.dmp
        Download

        memory/6056-17-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-20-0x0000000075020000-0x00000000757DC000-memory.dmp
        Download

        memory/6056-1-0x00000000030D0000-0x00000000030D8000-memory.dmp
        Download