Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 09:29
General
- Target 2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop.exe
- Size 472KB
- Sample260711-lf3dssft2j
- SHA256 3b266d06d91896cf897219f4bd7ca558ee3556e5b0db6a1f2f16d3cdaebc57c2
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dfs8301.tmp
memory/2972-13-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-14-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-6-0x0000000005320000-0x000000000536A000-memory.dmp
memory/2972-0-0x0000000000A10000-0x0000000000AA5000-memory.dmp
memory/2972-8-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-9-0x0000000005B70000-0x000000000612A000-memory.dmp
memory/2972-10-0x00000000055B0000-0x0000000005642000-memory.dmp
memory/2972-11-0x0000000005570000-0x000000000557A000-memory.dmp
memory/2972-2-0x0000000074BD2000-0x0000000074BD3000-memory.dmp
memory/2972-12-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-7-0x0000000001480000-0x000000000148C000-memory.dmp
memory/2972-15-0x0000000009600000-0x0000000009666000-memory.dmp
memory/2972-24-0x000000000E4E0000-0x000000000EC86000-memory.dmp
memory/2972-25-0x0000000074BD2000-0x0000000074BD3000-memory.dmp
memory/2972-26-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-27-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-28-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-29-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/2972-30-0x0000000000A10000-0x0000000000AA5000-memory.dmp