Overview

overview

10

Static

static

10

2026-06-27...ar.exe

windows10-2004-x64

8

2026-06-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    112s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_00205fef5a01ec85fd1f3deef13243df_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
  • Size 2.4MB
  • Sample260629-msd3eads3m
  • SHA256 e7acc68eb6ebd67392e7ebe61af88da2bbeed1698f160d2f48ee975b55acf72f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_00205fef5a01ec85fd1f3deef13243df_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_00205fef5a01ec85fd1f3deef13243df_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\ScreenConnect.WindowsClient.exe
        "C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\ScreenConnect.WindowsClient.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:908
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5472
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1936
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4840
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e.cdf-ms
        • Size 14KB
        • SHA256 5db26cfb85eeea58bcc8b1269f5d41472a87a87abd388104b73fbf00dc349dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23.cdf-ms
        • Size 3KB
        • SHA256 49665283ec5fd803df80415c880f8250c1225840d50e97af9193151359b30a99
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253.cdf-ms
        • Size 5KB
        • SHA256 64d1095466c93d37fb5cd0218db5ab4416bb56b3f4c9677888541e792adaed46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230.cdf-ms
        • Size 6KB
        • SHA256 785c0dc88d7b8f0cd623b87d9ed5de6beefa97c14a11419edb069e4f488831af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527.cdf-ms
        • Size 2KB
        • SHA256 8308a52130759915f457d31c85a0273917edb170bf833d08a0cb6d89ed826f41
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b.cdf-ms
        • Size 4KB
        • SHA256 ea3ddb336ff8d88ce83bbc784e61474507e6659ee3a47cbace90024be146efe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\MWW6WP4W.1O3\D0PX3JVG.BGA\manifests\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e.cdf-ms
        • Size 4KB
        • SHA256 5cfa2266aa89ec71d41c47cd79c106fe8f173f65edb5608ec61463870ab2cb9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.Client.dll
        • Size 399KB
        • SHA256 96dadc1c6b6b5cb56e6acb55f52357e52ed3877790e103d4ec9804b8ffa66c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.Client.dll.genman
        • Size 1KB
        • SHA256 b1827e6f0105476ea43157a5c7a2939623e2ce1c74810fb1b7346dbd6ce11593
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.ClientService.dll
        • Size 78KB
        • SHA256 7510a3270807d5ac03b28937ec7c7fa485a49e3b6c36e63c30d664e191d81caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.ClientService.dll.genman
        • Size 1KB
        • SHA256 637528deb39d79072423518b78a8df62711d48233739aac9dfc688ee435270e8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 a5c75fdc9bceecbf9a873a1c66eec3dcc87f66f5e973d9dd9937b8a5d7a3c603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.Core.dll
        • Size 553KB
        • SHA256 c14f8d29d5d0ff8d63a3a37608e4f886486f9fc8484082496d9aefc51865c758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.Core.dll.genman
        • Size 1KB
        • SHA256 28bff8e33bf544606596c065d8e1a6ce0dc5bf06b81895225367ff2e839f1109
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 d4fba5ffd6bb627827a922573cdaadc0e85d653d6844c3e4255860cbb7c7531a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.Windows.dll.genman
        • Size 1KB
        • SHA256 a81540a6837503404dda20ab0e4e387aaf29028295e1a1480b3496cb94dd50c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsBackstageShell.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.WindowsBackstageShell.exe
        • Size 59KB
        • SHA256 c459b5a1e6d13093f0c0ed218c4d9af9b74f6d83975c8fae52ca1f24cda36d98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.WindowsClient.exe
        • Size 604KB
        • SHA256 82477cdde7d90092fd2fe8b331d41851a2fa42f79e64721307b59e02c789a887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.WindowsClient.exe.genman
        • Size 2KB
        • SHA256 95dc27a4addbfcbf999321f3e522d138701d40cea52435c760c4f9b48545517b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.WindowsClient.exe.manifest
        • Size 7KB
        • SHA256 da9096dc05bfe7d043f7e59831ff81fc8d268e12fc885258c47c28437a2dd403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsFileManager.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2H5ODY.L9J\JWMLZO5H.CH3\ScreenConnect.WindowsFileManager.exe
        • Size 79KB
        • SHA256 d5465efd50c55dd1d4537b2813181b6a69a0536aed1da314d40c2c102ce63972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        39OQ39WT.QO3.application
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\K817QM1P.A31\39OQ39WT.QO3.application
        • Size 139KB
        • SHA256 e049618290bb7ef525a2233bb48f5042f2ca0e2516d73f84d8e1d0b0541efa4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/908-299-0x0000000002D10000-0x0000000002D28000-memory.dmp
        Download

        memory/908-288-0x0000000000970000-0x0000000000A0C000-memory.dmp
        Download

        memory/2336-17-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-13-0x000001D024130000-0x000001D0242B8000-memory.dmp
        Download

        memory/2336-36-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-46-0x000001D0243C0000-0x000001D0243D8000-memory.dmp
        Download

        memory/2336-26-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-52-0x000001D028A20000-0x000001D028BCE000-memory.dmp
        Download

        memory/2336-25-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-24-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-58-0x000001D028750000-0x000001D0287DE000-memory.dmp
        Download

        memory/2336-64-0x000001D028760000-0x000001D0287FC000-memory.dmp
        Download

        memory/2336-23-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-70-0x000001D028730000-0x000001D028798000-memory.dmp
        Download

        memory/2336-22-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-21-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-20-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-301-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-18-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-300-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-16-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-15-0x00007FFBEB4BF000-0x00007FFBEB4C0000-memory.dmp
        Download

        memory/2336-294-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp
        Download

        memory/2336-35-0x000001D028430000-0x000001D028480000-memory.dmp
        Download

        memory/2336-12-0x000001D0098C0000-0x000001D0098C8000-memory.dmp
        Download

        memory/2756-349-0x000002DD940E0000-0x000002DD94100000-memory.dmp
        Download

        memory/2756-303-0x000002DD801E0000-0x000002DD802E0000-memory.dmp
        Download

        memory/2756-316-0x000002DD81920000-0x000002DD81940000-memory.dmp
        Download

        memory/2756-326-0x000002DD81B60000-0x000002DD81B80000-memory.dmp
        Download

        memory/2756-304-0x000002DD801E0000-0x000002DD802E0000-memory.dmp
        Download

        memory/2756-317-0x000002DD81D60000-0x000002DD81E60000-memory.dmp
        Download

        memory/4448-5-0x0000000003330000-0x0000000003354000-memory.dmp
        Download

        memory/4448-6-0x0000000074790000-0x0000000074F4C000-memory.dmp
        Download

        memory/4448-3-0x0000000074790000-0x0000000074F4C000-memory.dmp
        Download

        memory/4448-14-0x0000000074790000-0x0000000074F4C000-memory.dmp
        Download

        memory/4448-2-0x0000000001A50000-0x0000000001A58000-memory.dmp
        Download

        memory/4448-0-0x00000000747A2000-0x00000000747A3000-memory.dmp
        Download

        memory/4448-19-0x0000000074790000-0x0000000074F4C000-memory.dmp
        Download

        memory/4448-4-0x00000000058D0000-0x000000000595E000-memory.dmp
        Download

        memory/4448-11-0x00000000747A2000-0x00000000747A3000-memory.dmp
        Download

        memory/4448-7-0x0000000005F20000-0x00000000064DA000-memory.dmp
        Download

        memory/4448-8-0x0000000005A00000-0x0000000005A92000-memory.dmp
        Download

        memory/4448-9-0x0000000074790000-0x0000000074F4C000-memory.dmp
        Download

        memory/4448-10-0x0000000005C60000-0x0000000005E0E000-memory.dmp
        Download

        memory/4448-1-0x0000000001930000-0x0000000001938000-memory.dmp
        Download