Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/07/2026, 16:30
General
- Target 2026-07-14_ad96090ad9bb7b7cb2204e6855045440_glassworm_mespinoza.exe
- Size 7.9MB
- Sample260714-tzzq1sbs8v
- SHA256 42117abdc8cc87cf1318776c446a411aefa965c806e7c91eafbd62b756afbc6c
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 30 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_ad96090ad9bb7b7cb2204e6855045440_glassworm_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_ad96090ad9bb7b7cb2204e6855045440_glassworm_mespinoza.exe"1⤵
- Enumerates connected drives
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3788-1-0x000001AC71BE0000-0x000001AC71BE5000-memory.dmp
memory/3788-3-0x000001AC71BE0000-0x000001AC71BE5000-memory.dmp
memory/3788-2-0x000001AC71BC0000-0x000001AC71BC7000-memory.dmp
memory/3788-6-0x000001AC71BE0000-0x000001AC71BE5000-memory.dmp
memory/3788-8-0x00007FFEA3D70000-0x00007FFEA3D80000-memory.dmp
memory/3788-0-0x00007FF6805D0000-0x00007FF680D94000-memory.dmp
memory/3788-9-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-12-0x00007FFEE64ED000-0x00007FFEE64EE000-memory.dmp
memory/3788-13-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-10-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-11-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-14-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-15-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-20-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-19-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-27-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-25-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-31-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-24-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-22-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp
memory/3788-34-0x00007FFEA3B70000-0x00007FFEA3B80000-memory.dmp
memory/3788-53-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-54-0x00007FFEA64D0000-0x00007FFEA64E0000-memory.dmp
memory/3788-55-0x00007FFEE6450000-0x00007FFEE6645000-memory.dmp