Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 01:26
General
- Target 2026-06-27_f205d3932067713841207442e1524a09_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
- Size 2.4MB
- Sample260629-btsfmsbv3n
- SHA256 81d0bd1ddfedda2e09aeca58cad4e84844964fe259a140fa58812ddcb9230066
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_f205d3932067713841207442e1524a09_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_f205d3932067713841207442e1524a09_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3364-0-0x0000000074AF2000-0x0000000074AF3000-memory.dmp
memory/3364-1-0x0000000002C60000-0x0000000002C68000-memory.dmp
memory/3364-2-0x0000000002C90000-0x0000000002C98000-memory.dmp
memory/3364-3-0x0000000005300000-0x000000000538E000-memory.dmp
memory/3364-4-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/3364-5-0x00000000053A0000-0x00000000053C4000-memory.dmp
memory/3364-7-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/3364-8-0x0000000005510000-0x00000000055A2000-memory.dmp
memory/3364-6-0x0000000005A30000-0x0000000005FEA000-memory.dmp
memory/3364-9-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/3364-10-0x00000000056C0000-0x000000000586E000-memory.dmp
memory/3364-17-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/3364-12-0x0000000074AF2000-0x0000000074AF3000-memory.dmp
memory/3364-13-0x0000000074AE0000-0x000000007529C000-memory.dmp
memory/3728-14-0x00007FF8F09CF000-0x00007FF8F09D0000-memory.dmp
memory/3728-21-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-16-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-18-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-11-0x000001EAE5F90000-0x000001EAE5F98000-memory.dmp
memory/3728-19-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-20-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-15-0x000001EB00000000-0x000001EB00188000-memory.dmp
memory/3728-22-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-23-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-24-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-25-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-26-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-27-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-28-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp
memory/3728-29-0x00007FF8F0840000-0x00007FF8F11E4000-memory.dmp