Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe
- Size 209KB
- Sample260629-plpxfae12p
- SHA256 307793ecca20f44e3f99ee976e85f5b6ab738109bae44d2c0d19722171ea09e5
- MD5 c7220b2076eee2fa9d707f78d6cb7a97
- SHA1 b455e781b170f5ba11bdcf4ed13dbc7d5639144b
- SHA512 e9fc79a464aaebe8a6264486cd906ce5cd084b9e72c1c703f28c8d3a0b5c0fc85f8ab784bb5f9e766508c01085dde9a44a6ceea8f2a5c264b0d8b62f59f5631e
- SSDEEP 6144:urcnkFVlE4SUYpwrvQOWC3jUgCj2b44RQi/:gcn+lElpwr4Ob3Abq44RV/
- TLSH T1C324F109E6932CFCDF4BD0B5A5975B32E573F8250232DD7BA390C6352E21B159E38829
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 4 IoCs
resource yara_rule behavioral2/memory/4704-11-0x00007FF6D3FE0000-0x00007FF6D4017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4704-24-0x00007FF6D3FE0000-0x00007FF6D4017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4704-27-0x00007FF6D3FE0000-0x00007FF6D4017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4704-32-0x00007FF6D3FE0000-0x00007FF6D4017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 18 raw.githubusercontent.com 19 raw.githubusercontent.com 20 raw.githubusercontent.com 1 raw.githubusercontent.com 14 raw.githubusercontent.com 15 raw.githubusercontent.com 25 raw.githubusercontent.com 9 raw.githubusercontent.com 16 raw.githubusercontent.com - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 5 api.ipify.org - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 6120 WMIC.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 6120 WMIC.exe 6120 WMIC.exe 6120 WMIC.exe 6120 WMIC.exe 5456 WMIC.exe 5456 WMIC.exe 5456 WMIC.exe 5456 WMIC.exe 2320 WMIC.exe 2320 WMIC.exe 2320 WMIC.exe 2320 WMIC.exe 6696 WMIC.exe 6696 WMIC.exe 6696 WMIC.exe 6696 WMIC.exe 5552 WMIC.exe 5552 WMIC.exe 5552 WMIC.exe 5552 WMIC.exe 5896 WMIC.exe 5896 WMIC.exe 5896 WMIC.exe 5896 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 6120 WMIC.exe Token: SeSecurityPrivilege 6120 WMIC.exe Token: SeTakeOwnershipPrivilege 6120 WMIC.exe Token: SeLoadDriverPrivilege 6120 WMIC.exe Token: SeSystemProfilePrivilege 6120 WMIC.exe Token: SeSystemtimePrivilege 6120 WMIC.exe Token: SeProfSingleProcessPrivilege 6120 WMIC.exe Token: SeIncBasePriorityPrivilege 6120 WMIC.exe Token: SeCreatePagefilePrivilege 6120 WMIC.exe Token: SeBackupPrivilege 6120 WMIC.exe Token: SeRestorePrivilege 6120 WMIC.exe Token: SeShutdownPrivilege 6120 WMIC.exe Token: SeDebugPrivilege 6120 WMIC.exe Token: SeSystemEnvironmentPrivilege 6120 WMIC.exe Token: SeRemoteShutdownPrivilege 6120 WMIC.exe Token: SeUndockPrivilege 6120 WMIC.exe Token: SeManageVolumePrivilege 6120 WMIC.exe Token: 33 6120 WMIC.exe Token: 34 6120 WMIC.exe Token: 35 6120 WMIC.exe Token: 36 6120 WMIC.exe Token: SeIncreaseQuotaPrivilege 6120 WMIC.exe Token: SeSecurityPrivilege 6120 WMIC.exe Token: SeTakeOwnershipPrivilege 6120 WMIC.exe Token: SeLoadDriverPrivilege 6120 WMIC.exe Token: SeSystemProfilePrivilege 6120 WMIC.exe Token: SeSystemtimePrivilege 6120 WMIC.exe Token: SeProfSingleProcessPrivilege 6120 WMIC.exe Token: SeIncBasePriorityPrivilege 6120 WMIC.exe Token: SeCreatePagefilePrivilege 6120 WMIC.exe Token: SeBackupPrivilege 6120 WMIC.exe Token: SeRestorePrivilege 6120 WMIC.exe Token: SeShutdownPrivilege 6120 WMIC.exe Token: SeDebugPrivilege 6120 WMIC.exe Token: SeSystemEnvironmentPrivilege 6120 WMIC.exe Token: SeRemoteShutdownPrivilege 6120 WMIC.exe Token: SeUndockPrivilege 6120 WMIC.exe Token: SeManageVolumePrivilege 6120 WMIC.exe Token: 33 6120 WMIC.exe Token: 34 6120 WMIC.exe Token: 35 6120 WMIC.exe Token: 36 6120 WMIC.exe Token: SeIncreaseQuotaPrivilege 5456 WMIC.exe Token: SeSecurityPrivilege 5456 WMIC.exe Token: SeTakeOwnershipPrivilege 5456 WMIC.exe Token: SeLoadDriverPrivilege 5456 WMIC.exe Token: SeSystemProfilePrivilege 5456 WMIC.exe Token: SeSystemtimePrivilege 5456 WMIC.exe Token: SeProfSingleProcessPrivilege 5456 WMIC.exe Token: SeIncBasePriorityPrivilege 5456 WMIC.exe Token: SeCreatePagefilePrivilege 5456 WMIC.exe Token: SeBackupPrivilege 5456 WMIC.exe Token: SeRestorePrivilege 5456 WMIC.exe Token: SeShutdownPrivilege 5456 WMIC.exe Token: SeDebugPrivilege 5456 WMIC.exe Token: SeSystemEnvironmentPrivilege 5456 WMIC.exe Token: SeRemoteShutdownPrivilege 5456 WMIC.exe Token: SeUndockPrivilege 5456 WMIC.exe Token: SeManageVolumePrivilege 5456 WMIC.exe Token: 33 5456 WMIC.exe Token: 34 5456 WMIC.exe Token: 35 5456 WMIC.exe Token: 36 5456 WMIC.exe Token: SeIncreaseQuotaPrivilege 5456 WMIC.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4704 wrote to memory of 2348 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 89 PID 2348 wrote to memory of 6120 2348 cmd.exe 91 PID 4704 wrote to memory of 2676 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 93 PID 2676 wrote to memory of 5456 2676 cmd.exe 95 PID 4704 wrote to memory of 2252 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 96 PID 2252 wrote to memory of 2320 2252 cmd.exe 98 PID 4704 wrote to memory of 5004 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 99 PID 5004 wrote to memory of 6696 5004 cmd.exe 101 PID 4704 wrote to memory of 4556 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 102 PID 4556 wrote to memory of 5552 4556 cmd.exe 104 PID 4704 wrote to memory of 5368 4704 2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe 105 PID 5368 wrote to memory of 5896 5368 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_c7220b2076eee2fa9d707f78d6cb7a97_conti_glassworm.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic path win32_videocontroller get name2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6120
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic bios get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic baseboard get manufacturer2⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6696
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic cpu get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5552
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic diskdrive get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5896
-
-