Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 15:51
General
- Target 2026-07-23_5c30db299859168990c9a4c9731aba69_glassworm_mespinoza.exe
- Size 7.9MB
- Sample260723-tap6aascrd
- SHA256 8b553f719a92a71c1b2894a97eb596a5ad404d724bfc39ce108747f303950e39
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 30 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_5c30db299859168990c9a4c9731aba69_glassworm_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_5c30db299859168990c9a4c9731aba69_glassworm_mespinoza.exe"1⤵
- Enumerates connected drives
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4356-1-0x000002A0D1FC0000-0x000002A0D1FC5000-memory.dmp
memory/4356-2-0x000002A0D1FA0000-0x000002A0D1FA7000-memory.dmp
memory/4356-3-0x000002A0D1FC0000-0x000002A0D1FC5000-memory.dmp
memory/4356-0-0x00007FF708E80000-0x00007FF709644000-memory.dmp
memory/4356-6-0x000002A0D1FC0000-0x000002A0D1FC5000-memory.dmp
memory/4356-10-0x00007FFC0AFC0000-0x00007FFC0AFD0000-memory.dmp
memory/4356-12-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-13-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-14-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-16-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-20-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-19-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-21-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-26-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-23-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-30-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-17-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp
memory/4356-31-0x00007FFC0B610000-0x00007FFC0B620000-memory.dmp
memory/4356-15-0x00007FFC4D68D000-0x00007FFC4D68E000-memory.dmp
memory/4356-11-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-52-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-53-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp
memory/4356-54-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp