Analysis
- max time kernel
9s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 16:28
General
- Target 2026-07-07_250f5ac00246deba515ae9508d12908e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 12.2MB
- Sample260707-tymeashy2x
- SHA256 4a8818ab04c702774813ccb2b2aa22d066210876ef6ebec77239e72e51ec4399
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_250f5ac00246deba515ae9508d12908e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_250f5ac00246deba515ae9508d12908e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.3.11.9650\9cefb0e3ad8d3587\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-07_250f5ac00246deba515ae9508d12908e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E3A02C3F45E5FC9E1155C9C9562F7A87 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI69DC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740953 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6C3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741484 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7085.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240742578 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D225D463DE7F96B5105374DECF83DC0E2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E37E9BD64B31AE1450C7826BE78E5B7 E Global\MSI00002⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\ScreenConnect Client (9cefb0e3ad8d3587)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (9cefb0e3ad8d3587)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-db6x90-relay.screenconnect.com&p=443&s=01d7dff7-a4e4-416c-b44f-89444b174d0f&k=BgIAAACkAABSU0ExAAgAAAEAAQANMMY4H%2faov8IIjr1pb1HQgoPKmOtSfRwUnpY2kcw4GV5Ff2Vs2iqmuHa7svdD6lHct%2fH%2bbgH2m3R%2f37sdp6ZE%2fLTh1Lflol8xUJq1a5EzuK%2fzucNrySwj5j9a4g1vyfQZupNKVNrmnw7FChIo%2fciQbfaYSzIU8e5XyDafEEppBKZiYANhe6%2fm0iycDwVkl4yEZGhYH8vtl4pgSFulokPPq3lHWtRN82nuL%2fhxtlBTjnc%2fV4Zaul9U5tEd50x1XNvSVLTywEC%2b7OR8wuK0jO4k2kN3F%2fiuTknmQ3UVjtaybzTTHopQhLrXNAoxLVqkiRU9kaz4JMs3zDo8XXoNuSmh"1⤵
-
C:\Program Files (x86)\ScreenConnect Client (9cefb0e3ad8d3587)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (9cefb0e3ad8d3587)\ScreenConnect.WindowsClient.exe" "RunRole" "2fa93c3b-ecb5-45b6-9670-a5c0886f24db" "User"2⤵
-
-
C:\Program Files (x86)\ScreenConnect Client (9cefb0e3ad8d3587)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (9cefb0e3ad8d3587)\ScreenConnect.WindowsClient.exe" "RunRole" "2d57b6b4-1217-4325-9f07-29c2d7859f99" "System"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e59b9f1.rbs
Client.en-US.resources
Client.resources
ScreenConnect.Client.dll
ScreenConnect.ClientService.dll
ScreenConnect.ClientService.exe
ScreenConnect.Core.dll
ScreenConnect.Windows.dll
ScreenConnect.WindowsAuthenticationPackage.dll
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsClient.exe.config
ScreenConnect.WindowsCredentialProvider.dll
system.config
MSI69DC.tmp
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.WindowsInstaller.dll
ScreenConnect.ClientSetup.msi
MSIBF5F.tmp
isp41wlv.newcfg
user.config
vta31ygx.newcfg
memory/968-46-0x0000000005CE0000-0x0000000005D74000-memory.dmp
memory/968-50-0x0000000005F30000-0x00000000060E0000-memory.dmp
memory/968-42-0x0000000003B40000-0x0000000003B4C000-memory.dmp
memory/968-38-0x0000000003B50000-0x0000000003B7E000-memory.dmp
memory/1112-80-0x0000000005C90000-0x0000000005CB8000-memory.dmp
memory/1344-11-0x00000000742C2000-0x00000000742C3000-memory.dmp
memory/1344-3-0x00000000742B0000-0x0000000074A6C000-memory.dmp
memory/1344-1-0x00000000027A0000-0x00000000027A8000-memory.dmp
memory/1344-9-0x00000000069C0000-0x0000000006A52000-memory.dmp
memory/1344-8-0x0000000006EA0000-0x000000000745A000-memory.dmp
memory/1344-15-0x00000000742B0000-0x0000000074A6C000-memory.dmp
memory/1344-14-0x00000000742B0000-0x0000000074A6C000-memory.dmp
memory/1344-7-0x00000000742B0000-0x0000000074A6C000-memory.dmp
memory/1344-10-0x00000000742B0000-0x0000000074A6C000-memory.dmp
memory/1344-2-0x00000000027C0000-0x00000000027CC000-memory.dmp
memory/1344-12-0x00000000742B0000-0x0000000074A6C000-memory.dmp
memory/1344-4-0x0000000006670000-0x0000000006704000-memory.dmp
memory/1344-6-0x0000000006730000-0x00000000068E0000-memory.dmp
memory/1344-5-0x0000000004110000-0x0000000004138000-memory.dmp
memory/1344-0-0x00000000742C2000-0x00000000742C3000-memory.dmp
memory/2024-225-0x000000001B440000-0x000000001B5F0000-memory.dmp
memory/2024-223-0x000000001AD30000-0x000000001AD9C000-memory.dmp
memory/2024-226-0x0000000002210000-0x000000000222A000-memory.dmp
memory/2024-224-0x000000001ADA0000-0x000000001AE34000-memory.dmp
memory/2024-222-0x0000000000030000-0x00000000000DC000-memory.dmp
memory/2024-227-0x000000001B780000-0x000000001B908000-memory.dmp
memory/2024-230-0x000000001AE60000-0x000000001AF8F000-memory.dmp
memory/5548-180-0x00000000047C0000-0x0000000004810000-memory.dmp
memory/5548-201-0x0000000004810000-0x0000000004851000-memory.dmp
memory/5548-203-0x0000000004D50000-0x0000000004E26000-memory.dmp
memory/5548-199-0x0000000004880000-0x00000000048EC000-memory.dmp
memory/5548-157-0x00000000045A0000-0x00000000045BA000-memory.dmp
memory/5548-167-0x0000000004910000-0x0000000004AC0000-memory.dmp
memory/5548-163-0x00000000046C0000-0x0000000004754000-memory.dmp
memory/5648-229-0x000000001AFA0000-0x000000001B0CF000-memory.dmp