Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/08/2026, 10:45
General
- Target 2026-08-01_8fa4a4c57d83f14f959d6ec80d2b7847_glassworm_mespinoza.exe
- Size 7.9MB
- Sample260801-mttjgsshnd
- SHA256 5fcce718bb9df3fde495117c80cca2825e8f9771cb2cf5b2080f2faf94124ce2
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 22 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_8fa4a4c57d83f14f959d6ec80d2b7847_glassworm_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8fa4a4c57d83f14f959d6ec80d2b7847_glassworm_mespinoza.exe"1⤵
- Enumerates connected drives
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3980-3-0x000001A9F5A10000-0x000001A9F5A15000-memory.dmp
memory/3980-2-0x000001A9F59F0000-0x000001A9F59F7000-memory.dmp
memory/3980-1-0x000001A9F5A10000-0x000001A9F5A15000-memory.dmp
memory/3980-6-0x000001A9F5A10000-0x000001A9F5A15000-memory.dmp
memory/3980-8-0x00007FF8E8910000-0x00007FF8E8920000-memory.dmp
memory/3980-0-0x00007FF78D5A0000-0x00007FF78DD64000-memory.dmp
memory/3980-12-0x00007FF92B02D000-0x00007FF92B02E000-memory.dmp
memory/3980-13-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-14-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-11-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-18-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-21-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-23-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-25-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-17-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-26-0x00007FF8E87B0000-0x00007FF8E87C0000-memory.dmp
memory/3980-16-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-15-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp
memory/3980-10-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-9-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-44-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-43-0x00007FF8EB010000-0x00007FF8EB020000-memory.dmp
memory/3980-46-0x00007FF92AF90000-0x00007FF92B185000-memory.dmp