Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 21:16
Behavioral task
behavioral1
Sample
2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe
- Size 3.3MB
- Sample260706-z4ybmsgz4k
- SHA256 eae5fd4c3aeb4c6c812750e8d510c7e04676c7bc09826ae1962215288e05f270
- MD5 6a05337a6aae110d750fff2ff3abe1de
- SHA1 4c02939f86f50481d9da979becd83b27734aa28c
- SHA512 76c17cc36d0b83a2ca2696db42516b33a126537fb4a1df31ebff0204ca8bab14052cf3840e26bee92469f3b98fffd3e8f67d31e95961743a81d1ee7252323071
- SSDEEP 24576:PGtJQzN/AUKd/Yp5zXgHr36daE/ol4uuJ5MMJ5MuVkJJFo3Q+qdCOy0F7d:OtGzNIUg/6FwLXW04uq5MA5M1OQ+q8M
- TLSH T1C8F53813B7D08632D6AA56704CAF039A2738FD178BA28B8F7684772C6E733845E35D54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3512 created 748 3512 Explorer.EXE 5 - Detects executables packed with VMProtect. 18 IoCs
resource yara_rule behavioral2/memory/5732-0-0x00000000005D0000-0x00000000006D7000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5732-1-0x00000000005D0000-0x00000000006D7000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5732-11-0x00000000005D0000-0x00000000006D7000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3512-18-0x000000000DC10000-0x000000000DEA5000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3512-19-0x000000000DC10000-0x000000000DEA5000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-30-0x00000243DC6D0000-0x00000243DC937000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-32-0x00000243DC6D0000-0x00000243DC937000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-38-0x00000243DC6D0000-0x00000243DC937000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3512-42-0x000000000DC10000-0x000000000DEA5000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-44-0x00000243DC6D0000-0x00000243DC937000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-68-0x00000243DE7C0000-0x00000243DE996000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-69-0x00000243DE7C0000-0x00000243DE996000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-71-0x00000243DE7C0000-0x00000243DE996000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-81-0x00000243DEF00000-0x00000243DF1FF000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/3408-82-0x00000243DEF00000-0x00000243DF1FF000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/files/0x001000000001c59b-104.dat INDICATOR_EXE_Packed_VMProtect behavioral2/files/0x000f00000001c5b3-191.dat INDICATOR_EXE_Packed_VMProtect behavioral2/memory/5732-292-0x00000000005D0000-0x00000000006D7000-memory.dmp INDICATOR_EXE_Packed_VMProtect - Drops file in Drivers directory 5 IoCs
description ioc Process File created C:\Windows\System32\drivers\W42Ydh3K.sys isoburn.exe File opened for modification C:\Windows\system32\drivers\cEQ75VRJDDLG70.sys isoburn.exe File opened for modification C:\Windows\system32\drivers\KdNlm6Afpb.rhs isoburn.exe File opened for modification C:\Windows\system32\drivers\BedI4W6Vnc99nO.sys isoburn.exe File opened for modification C:\Windows\system32\drivers\XrSOy5NNbGOPS.ork isoburn.exe - Executes dropped EXE 1 IoCs
pid Process 3408 isoburn.exe - Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 3408 isoburn.exe -
resource yara_rule behavioral2/memory/5732-0-0x00000000005D0000-0x00000000006D7000-memory.dmp vmprotect behavioral2/memory/5732-1-0x00000000005D0000-0x00000000006D7000-memory.dmp vmprotect behavioral2/memory/5732-11-0x00000000005D0000-0x00000000006D7000-memory.dmp vmprotect behavioral2/memory/3512-18-0x000000000DC10000-0x000000000DEA5000-memory.dmp vmprotect behavioral2/memory/3512-19-0x000000000DC10000-0x000000000DEA5000-memory.dmp vmprotect behavioral2/memory/3512-42-0x000000000DC10000-0x000000000DEA5000-memory.dmp vmprotect behavioral2/memory/3408-81-0x00000243DEF00000-0x00000243DF1FF000-memory.dmp vmprotect behavioral2/memory/3408-82-0x00000243DEF00000-0x00000243DF1FF000-memory.dmp vmprotect behavioral2/files/0x001000000001c59b-104.dat vmprotect behavioral2/files/0x000f00000001c5b3-191.dat vmprotect behavioral2/memory/5732-292-0x00000000005D0000-0x00000000006D7000-memory.dmp vmprotect - Drops file in System32 directory 52 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6830.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F37A9.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3920.cat isoburn.exe File opened for modification C:\Windows\system32\2f25QtZcB7.sys isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F6CB9C3EDDE9F4094DC52F2615C2B6D9 isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F39AD.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3A97.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6773.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F67D0.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6800.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_8DC7EFDA5BB80D31EBB578CDECA2639E isoburn.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\BFEnK4nc.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3779.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3806.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3950.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3A0A.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F659F.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6716.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 isoburn.exe File opened for modification C:\Windows\system32\uee3z8Qq5gu4TH.sys isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F69D4.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F397D.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6428.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F65CC.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F662C.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6659.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F isoburn.exe File opened for modification C:\Windows\system32\3n8VV40ANLaK.zyp isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3836.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3863.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F38C3.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3A3A.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3A67.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02 isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02 isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F64E2.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F688D.cat isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F6ABE.cat isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_8DC7EFDA5BB80D31EBB578CDECA2639E isoburn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F6CB9C3EDDE9F4094DC52F2615C2B6D9 isoburn.exe File created C:\Windows\system32\ \Windows\System32\oXftVH.sys isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F39DA.cat isoburn.exe File opened for modification C:\Windows\system32\dkVYG0KWUb4wjc.mhq isoburn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F66E6.cat isoburn.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\lib\6478e551.js isoburn.exe File opened for modification C:\Program Files\GKA8JRr6xX.sys isoburn.exe File opened for modification C:\Program Files (x86)\AYYlTNBoNVt.sys isoburn.exe File opened for modification C:\Program Files\WindowsApps\3969a79c.js isoburn.exe File opened for modification C:\Program Files\jRodWBmZP1kAz.sys isoburn.exe File opened for modification C:\Program Files\T22KYFyCiQfm.tgg isoburn.exe File opened for modification C:\Program Files (x86)\lbliZef2JXNSz.sys isoburn.exe File opened for modification C:\Program Files (x86)\VBqyp53W7Qfo.eto isoburn.exe File opened for modification C:\Program Files\1fAIoqfJIH.hnh isoburn.exe File opened for modification C:\Program Files (x86)\y5kDx5SvD0gUXV.cpa isoburn.exe File opened for modification C:\Program Files\WindowsApps\manifest.json isoburn.exe File opened for modification C:\Program Files\WindowsApps\47c41183.html isoburn.exe File opened for modification C:\Program Files\WindowsApps\561e7b6a.js isoburn.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\aPH11GEeJvUEFp.gle isoburn.exe File opened for modification C:\Windows\KKxYdqSOmB8fEa.sys isoburn.exe File opened for modification C:\Windows\EddCbfF2TOfT3.zjx isoburn.exe File created C:\Windows\iRYgNa.sys isoburn.exe File opened for modification C:\Windows\rXm6sJyCkeyb.sys isoburn.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName isoburn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 isoburn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 isoburn.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1176 timeout.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix isoburn.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" isoburn.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" isoburn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" isoburn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" isoburn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ isoburn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" isoburn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" isoburn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing isoburn.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 3512 Explorer.EXE 3512 Explorer.EXE 3512 Explorer.EXE 3512 Explorer.EXE 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe 3408 isoburn.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3512 Explorer.EXE - Suspicious behavior: LoadsDriver 35 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe Token: SeTcbPrivilege 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe Token: SeDebugPrivilege 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe Token: SeDebugPrivilege 3512 Explorer.EXE Token: SeDebugPrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeDebugPrivilege 3408 isoburn.exe Token: SeDebugPrivilege 3408 isoburn.exe Token: SeDebugPrivilege 3408 isoburn.exe Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3512 Explorer.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5732 wrote to memory of 3512 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 51 PID 5732 wrote to memory of 3512 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 51 PID 5732 wrote to memory of 3512 5732 2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe 51 PID 3512 wrote to memory of 3408 3512 Explorer.EXE 87 PID 3512 wrote to memory of 3408 3512 Explorer.EXE 87 PID 3512 wrote to memory of 3408 3512 Explorer.EXE 87 PID 3512 wrote to memory of 3408 3512 Explorer.EXE 87 PID 3512 wrote to memory of 1932 3512 Explorer.EXE PID 3512 wrote to memory of 5912 3512 Explorer.EXE PID 3512 wrote to memory of 5160 3512 Explorer.EXE PID 3408 wrote to memory of 2588 3408 isoburn.exe 92 PID 3408 wrote to memory of 2588 3408 isoburn.exe 92 PID 3408 wrote to memory of 2588 3408 isoburn.exe 92 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3512 wrote to memory of 884 3512 Explorer.EXE PID 3512 wrote to memory of 5472 3512 Explorer.EXE PID 3512 wrote to memory of 2652 3512 Explorer.EXE PID 3512 wrote to memory of 1272 3512 Explorer.EXE PID 3512 wrote to memory of 3268 3512 Explorer.EXE PID 3512 wrote to memory of 3028 3512 Explorer.EXE PID 3512 wrote to memory of 2840 3512 Explorer.EXE PID 3512 wrote to memory of 5264 3512 Explorer.EXE PID 3512 wrote to memory of 3572 3512 Explorer.EXE PID 3512 wrote to memory of 5688 3512 Explorer.EXE PID 3512 wrote to memory of 1648 3512 Explorer.EXE PID 3512 wrote to memory of 3120 3512 Explorer.EXE PID 3512 wrote to memory of 2980 3512 Explorer.EXE PID 3512 wrote to memory of 4872 3512 Explorer.EXE PID 3512 wrote to memory of 4016 3512 Explorer.EXE PID 3512 wrote to memory of 4844 3512 Explorer.EXE PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51 PID 3408 wrote to memory of 3512 3408 isoburn.exe 51
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:748
-
C:\isoburn.exe"C:\isoburn.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\system32\shrpubw.exe"C:\Windows\system32\shrpubw.exe"3⤵PID:2588
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\2026-07-06_6a05337a6aae110d750fff2ff3abe1de_amadey_elex_glassworm_hellokitty_mafia_remcos_stop.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1176
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\KKxYdqSOmB8fEa.sys
- Size 186KB
- SHA256 bab7f9576c925c73de4ef89df2d277651233c323100a2857d54e7d44c34755c2
- MD5 76e69e204e71c9649304d30d88696b8c
- SHA1 8bee921ff3f4e200e61bf6ee860ffe8e030104f1
- SHA512 40fb5e1982b0d18ee9bffaab0dfda6e675c9d800c5bb5abcb854fbbbb2e2cc402f061a76d8658f4c2c1cf589f8aaa98e2565719d18f4e3462cc89336c7f807a5
- SSDEEP 3072:hBS6eLsrGiwSBB13inSEdy8IGoBLco76b3l7AV+WqZbn801Ss4pZ/KEVFXvUHt4u:nIkBSvywoBLcE6xAqnb1SBHVpUHt4f
- TLSH T118141263929E42FFC805D53BEAA6BEE4C8767137EED48908D6D837293041DE5092713E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F3863.cat
- Size 5KB
- SHA256 61112b5e4aedc68d291e4fd7441e077fc37e0a625abf1c1b012004663ca68b35
- MD5 784bb97d4362cbec0a404dc60057edc4
- SHA1 7e71f2fab0c54faf7ea185aabe13c02b2e42bd10
- SHA512 22cfbd725430c38eef64ac6d61f451e029154e6d961f7a90f82c2ecf62505d79bca0c3807c695995ed6f673c5c5ba4aee09ca0ff686ea42eccb2cc28a849ab01
- SSDEEP 96:XmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOg:WIrXL0UIRIzw3jtlAur9ZCspE+TMQrOg
- TLSH T10DB1F7D709082456ED8A1F91D5C2D27F9D347BDA2EC8A5A2507292992FC3BE0BB0D40F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F662C.cat
- Size 5KB
- SHA256 ba97751ea630fd689ed1f7f29c0b3d2cba0226ea2c5214e7b1db689dad9d5442
- MD5 be22d25f8328d23d9e49b3911fba3ad6
- SHA1 5115bea5611fb6f0947c39e5b63256333234fa62
- SHA512 cbb16d8b0c9b1a2e4504d6f614aab4dad4756beb891f840f8b28701c6afc2dd1fa2798c1ceb92eff231cf82d4107ceb5f2891d3416d31406014d6163c7389796
- SSDEEP 96:OmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOFfLh:RIrXL0UIRIzw3jtlAur9ZCspE+TMQrOb
- TLSH T18FB1E7E70A082856ED865F90D5C6D62FDD3477D62EC865E3507292992EC2BF07B0D80F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\rXm6sJyCkeyb.sys
- Size 160KB
- SHA256 cbe4cd5b07477d6256ec67ee9e865fa44c41df1852a95c9553752c053e74590e
- MD5 0475cf35cbe497cbd8ac36b1a93fbf19
- SHA1 5aba3f0499a3f58848a77f954511c3f4f110ef62
- SHA512 6112efe87d28c55da9d7161d00de4fe23524a1ed550268808a95d5572f556968f9aed933a74ca44d8bf23598e0521ba834417ff52ff6a4700e978afb5f6c8455
- SSDEEP 3072:dd122CU6LdPkK0XxHNqDB0oB5b+yyru+EvwF9L5aav5AcxO8FB9RypCFOzx:T122CUiPk1JKLJyHEoFJq8upxx
- TLSH T1CDF302634A9927C3D40B887B951A90D45CF4B117FE098C06D285BEB2780ADDF7E5D0BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\isoburn.exe
- Size 144KB
- SHA256 d1a1d39f9bf328014301706e85664da384b49ac531c9332ad681957bb8b4a1b0
- MD5 719655f491446f800bc496d3d2ced776
- SHA1 3b9d797c066a57f8004bac7ea61339c0017cb568
- SHA512 11dac59c9af385c5eb5ed5c15e9b2efe679e3f6c3df25187e1226ce508fb233f78ef9803c0a41d838f39121c9b74802bbaf33f24bdc37a454e55c87cab9b4126
- SSDEEP 3072:Vp3C1U/Xg40EtfcKbh2sqa3bk3w+mqOhCeHd3:aC/g40EFcKbh2slbQ+qODHd3
- TLSH T1F7E35B4972A470D8E124817982338A29E771BC291B1127EF22E4F5BE1F737D16C3EE56
- MD5 SHA1 SHA512 SSDEEP TLSH