Overview

overview

10

Static

static

10

2026-07-06...ar.exe

windows10-2004-x64

6

2026-07-06...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 19:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_ecf5ffe25744b0f1ede3710900885a07_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
  • Size 2.4MB
  • Sample260706-yakb9acv2w
  • SHA256 0e87d1c18cc90b13c9d76945e647a7033fb30b66e8a7e2ceeb3264fed2da9014
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_ecf5ffe25744b0f1ede3710900885a07_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_ecf5ffe25744b0f1ede3710900885a07_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\scre..tion_0000000000000000_0019.0004_cbf866198ed687fd\ScreenConnect.WindowsClient.exe
        "C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\scre..tion_0000000000000000_0019.0004_cbf866198ed687fd\ScreenConnect.WindowsClient.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:2136
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3452
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2652
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms
        • Size 14KB
        • SHA256 7ac3eb3af28e07fd5f0e580661ae0166ae1b26d220e0881c8849c0721e3d8306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms
        • Size 3KB
        • SHA256 4b8715f54506f42703fe93f1dfe9ad0d52d2942ed9928fbbef22b013163c9e22
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms
        • Size 5KB
        • SHA256 3f5ad02ea74d35d115df384ac9189f7510d7704e8ff8ea98177f175ad62716ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms
        • Size 6KB
        • SHA256 5baf05a81bbd84c985a9a168e27affc42e0394cc1989e6e5c51e51c7ecd28d13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms
        • Size 2KB
        • SHA256 1766f7ceb9f5ba9af8ee39b83070c924c1ea8c9862dc8a28ae2b66ee65a35e86
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms
        • Size 4KB
        • SHA256 bad32ee8e2a5104dca6bff2fd29702744b33c20610431c79dab8497ecda0ec0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\AY939ZHM.6CT\YPKVY71H.CM9\manifests\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms
        • Size 4KB
        • SHA256 b288da4b0ef235c8a146cfc3f6ea64d7486d9626ebdca1098c5e3c6800f02a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 603B
        • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 595B
        • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        58EZXQG2.QPC.application
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\4RBYKR2T.734\58EZXQG2.QPC.application
        • Size 112KB
        • SHA256 4c327a6292a064e31a7ad88b2077103bb2484edbe366200c2d9b74cc044109a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.Client.dll
        • Size 228KB
        • SHA256 9507c29ca92f850426ba5a05647214f3f6e408853a2baef97892db5f7e974a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.Client.dll.genman
        • Size 1KB
        • SHA256 abedad01322bc77aaecf0e58331298f62daff9937666265931efc7995e7aa890
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.ClientService.dll
        • Size 78KB
        • SHA256 81d06d6f5c4dcca630d5001425566ab976e222082612f96dfc99078f585139ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.ClientService.dll.genman
        • Size 1KB
        • SHA256 97a3af25bfd040d4b7c09d39137024e3054db3e3ffc6d70c48c8e037bc7d28de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.Core.dll
        • Size 552KB
        • SHA256 dc3168bfff8b8bffb36f4374da4dfce8a96786a632eb6bdb666099fc0cf16a54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.Core.dll.genman
        • Size 1KB
        • SHA256 701043b60905f164f8c7eacbe72a8738948409475263bc331711895950a4edc0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 ff82ff2c60cebea3eb57b9d50e5ac1653009ff781d288f4b4b0c3578b2aefd30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.Windows.dll.genman
        • Size 1KB
        • SHA256 22a7184049b2294a26e2ae97f1e52a45dae7e375bd40bcef82d28afb76628549
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsBackstageShell.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.WindowsBackstageShell.exe
        • Size 59KB
        • SHA256 6cb34f11581e157628118bf39adc1effdc92ef81043632ad9f6b7952b85fb1eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.WindowsClient.exe
        • Size 599KB
        • SHA256 0fcf040e7c627085146cbe9ca77bc61d2dec0eacc500651fd2b02f76387a0c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.WindowsClient.exe.genman
        • Size 2KB
        • SHA256 aface8e8210443e62021751699279663bed2007af7a86d905f2ec7ba5dfc6ffe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.WindowsClient.exe.manifest
        • Size 7KB
        • SHA256 360f2c32f1675fd92ea4895693de10e849cf36b21f7c9952d6af4e7090cd8421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsFileManager.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\E633NJ0C.BMA\YDRLE47L.L4G\ScreenConnect.WindowsFileManager.exe
        • Size 79KB
        • SHA256 14525dd6476e98c5746aefc3386768c2320d3ed802e638ad1ff49dabb983229b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1852-8-0x0000000005670000-0x0000000005702000-memory.dmp
        Download

        memory/1852-10-0x00000000058D0000-0x0000000005A7E000-memory.dmp
        Download

        memory/1852-2-0x0000000002ED0000-0x0000000002ED8000-memory.dmp
        Download

        memory/1852-6-0x0000000074260000-0x0000000074A1C000-memory.dmp
        Download

        memory/1852-3-0x00000000054D0000-0x000000000555E000-memory.dmp
        Download

        memory/1852-9-0x0000000074260000-0x0000000074A1C000-memory.dmp
        Download

        memory/1852-1-0x0000000002EB0000-0x0000000002EB8000-memory.dmp
        Download

        memory/1852-7-0x0000000005B40000-0x00000000060FA000-memory.dmp
        Download

        memory/1852-0-0x0000000074272000-0x0000000074273000-memory.dmp
        Download

        memory/1852-14-0x0000000074260000-0x0000000074A1C000-memory.dmp
        Download

        memory/1852-5-0x0000000002F00000-0x0000000002F24000-memory.dmp
        Download

        memory/1852-11-0x0000000074272000-0x0000000074273000-memory.dmp
        Download

        memory/1852-18-0x0000000074260000-0x0000000074A1C000-memory.dmp
        Download

        memory/1852-4-0x0000000074260000-0x0000000074A1C000-memory.dmp
        Download

        memory/2136-296-0x0000000002CD0000-0x0000000002CE8000-memory.dmp
        Download

        memory/2136-286-0x00000000007C0000-0x000000000085A000-memory.dmp
        Download

        memory/2652-332-0x0000023481E40000-0x0000023481F40000-memory.dmp
        Download

        memory/2652-331-0x0000023481C60000-0x0000023481C80000-memory.dmp
        Download

        memory/2652-302-0x00000234801E0000-0x00000234802E0000-memory.dmp
        Download

        memory/2652-333-0x0000023481D60000-0x0000023481D80000-memory.dmp
        Download

        memory/2652-303-0x00000234801E0000-0x00000234802E0000-memory.dmp
        Download

        memory/2652-347-0x0000023494270000-0x0000023494290000-memory.dmp
        Download

        memory/2652-301-0x00000234801E0000-0x00000234802E0000-memory.dmp
        Download

        memory/3864-299-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-297-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-33-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-32-0x000001FEF3990000-0x000001FEF39E0000-memory.dmp
        Download

        memory/3864-23-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-12-0x000001FEEEBF0000-0x000001FEEEBF8000-memory.dmp
        Download

        memory/3864-16-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-56-0x000001FEF5AA0000-0x000001FEF5B3A000-memory.dmp
        Download

        memory/3864-50-0x000001FEF3B30000-0x000001FEF3B6E000-memory.dmp
        Download

        memory/3864-44-0x000001FEF5E00000-0x000001FEF5FAE000-memory.dmp
        Download

        memory/3864-34-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-22-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-298-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-13-0x000001FEF12F0000-0x000001FEF1478000-memory.dmp
        Download

        memory/3864-17-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-62-0x000001FEF5AA0000-0x000001FEF5B2E000-memory.dmp
        Download

        memory/3864-68-0x000001FEF1860000-0x000001FEF1878000-memory.dmp
        Download

        memory/3864-15-0x00007FFE35D9F000-0x00007FFE35DA0000-memory.dmp
        Download

        memory/3864-21-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-20-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download

        memory/3864-19-0x00007FFE35C10000-0x00007FFE365B4000-memory.dmp
        Download