Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 12:01
General
- Target 2026-07-12_aae271030caee714bafad72b0657c957_elex_glassworm_manuscrypt_rhadamanthys_stop.exe
- Size 472KB
- Sample260712-n7ccssht5r
- SHA256 cc51ef95c86bd78ccc18aa3c11a90f3e219530c7da76a4ff453d26ed20e56d80
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_aae271030caee714bafad72b0657c957_elex_glassworm_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_aae271030caee714bafad72b0657c957_elex_glassworm_manuscrypt_rhadamanthys_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dfs46DE.tmp
memory/2580-13-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-14-0x0000000009100000-0x0000000009166000-memory.dmp
memory/2580-6-0x0000000004E40000-0x0000000004E8A000-memory.dmp
memory/2580-0-0x0000000000A30000-0x0000000000AC5000-memory.dmp
memory/2580-8-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-9-0x0000000005620000-0x0000000005BDA000-memory.dmp
memory/2580-10-0x0000000005060000-0x00000000050F2000-memory.dmp
memory/2580-11-0x0000000005100000-0x000000000510A000-memory.dmp
memory/2580-2-0x00000000748D2000-0x00000000748D3000-memory.dmp
memory/2580-12-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-7-0x0000000002780000-0x000000000278C000-memory.dmp
memory/2580-15-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-21-0x000000000B7A0000-0x000000000BF46000-memory.dmp
memory/2580-25-0x00000000748D2000-0x00000000748D3000-memory.dmp
memory/2580-26-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-27-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-28-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-29-0x00000000748C0000-0x000000007507C000-memory.dmp
memory/2580-30-0x0000000000A30000-0x0000000000AC5000-memory.dmp