Analysis
- max time kernel
149s - max time network
21s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 11:41
General
- Target 2026-06-26_deec6cb8fdd57ce7c05e302fa4527b8e_glassworm_hiddentear_remcos.exe
- Size 197KB
- Sample260629-ntwvaad12q
- SHA256 7fead4ea38633470ad293745568ba703bf48a635976f1430cd3b79dd7bfddaf4
Malware Config
Signatures
- Detects executables packed with ConfuserEx Mod 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_deec6cb8fdd57ce7c05e302fa4527b8e_glassworm_hiddentear_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_deec6cb8fdd57ce7c05e302fa4527b8e_glassworm_hiddentear_remcos.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4080-0-0x00007FF9DB7FF000-0x00007FF9DB800000-memory.dmp
memory/4080-1-0x000001EA271E0000-0x000001EA27216000-memory.dmp
memory/4080-3-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-2-0x000001EA27660000-0x000001EA2767E000-memory.dmp
memory/4080-4-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-5-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-6-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-7-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-8-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-9-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-10-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-11-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp
memory/4080-12-0x00007FF9DB670000-0x00007FF9DC014000-memory.dmp