e4de6dcb0483aa613646c6c570f9331d436fccbc6e8e22ae66fc5604d02ee375

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe
Size 15.2MB
Sample260803-y42tdsbj4s
SHA256 e4de6dcb0483aa613646c6c570f9331d436fccbc6e8e22ae66fc5604d02ee375
MD5 fc1e0ab76a92f0cb43ffb2d7fa2dc7e5
SHA1 098e1c10f8fce60cf47b68104489dbc352fb0d3e
SHA512 e288b4b1bd93d229c85deee159990ab25cd4fc8eb2a4765fbc957d24faa82ac1d22d806cf8da7f25c141697cab24c9f900655ada2cb036554a7e35ddef490368
SSDEEP 196608:e+azUtnV951h0XCfQbG2E6iQ/74aZ/w1c1+:emHNzQa2EUj4aZvs
TLSH
T1CCF6AD01E2FC01A8F5BBC178C5665917E7B278551720E7EF51649AA82F33BD0AE3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4752	4j0hqex3.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3792	powershell.exe
1772	powershell.exe
2124	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3792	powershell.exe
3792	powershell.exe
1772	powershell.exe
1772	powershell.exe
2124	powershell.exe
2124	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeIncreaseQuotaPrivilege	3792	powershell.exe
Token: SeSecurityPrivilege	3792	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	powershell.exe
Token: SeLoadDriverPrivilege	3792	powershell.exe
Token: SeSystemProfilePrivilege	3792	powershell.exe
Token: SeSystemtimePrivilege	3792	powershell.exe
Token: SeProfSingleProcessPrivilege	3792	powershell.exe
Token: SeIncBasePriorityPrivilege	3792	powershell.exe
Token: SeCreatePagefilePrivilege	3792	powershell.exe
Token: SeBackupPrivilege	3792	powershell.exe
Token: SeRestorePrivilege	3792	powershell.exe
Token: SeShutdownPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeSystemEnvironmentPrivilege	3792	powershell.exe
Token: SeRemoteShutdownPrivilege	3792	powershell.exe
Token: SeUndockPrivilege	3792	powershell.exe
Token: SeManageVolumePrivilege	3792	powershell.exe
Token: 33	3792	powershell.exe
Token: 34	3792	powershell.exe
Token: 35	3792	powershell.exe
Token: 36	3792	powershell.exe
Token: SeDebugPrivilege	2428	2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3792	2428	2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe	89
PID 2428 wrote to memory of 1772	2428	2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe	92
PID 2428 wrote to memory of 2124	2428	2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe	94
PID 2428 wrote to memory of 4752	2428	2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try{$r=(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory;if(-not$r -or$r -lt 3221225472){exit 123}else{exit 0}}catch{exit 123}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\4j0hqex3.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc1e0ab76a92f0cb43ffb2d7fa2dc7e5_glassworm_megazord.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\4j0hqex3.exe
  "C:\Users\Admin\AppData\Local\Temp\4j0hqex3.exe"
  2⤵
  - Executes dropped EXE
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 723b9421b425ca5928fc061d31b209d4b14ef02b1f742d6b220513d91cb8fdf6
MD5 0dba332926882e1ee38eb25de88d9b9b
SHA1 4c975bae1dd1e427dc74318475e94ccd4ec7e2b2
SHA512 9c405a12c859e171d302f9398101fccc28336cbedee1d8448610ec3fc76a9e9935575856e428ddecf305b7416e95a782c0b56d9c08c3a5bfb8a4b14acba11e67
TLSH
T1FB217633B3DC8214CC9A003A10CDAC1032B687CB40DECF9B6B84E259A82F699DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b68768e36700eab5ffa240e430fcb1fca42320d033e3222b6a0b15472b6f7c33
MD5 408ecc6f2479e39cc934cf7dcbdfd2cc
SHA1 d00ea65a41bf20cce728652a3fb4ea42c3d1d37d
SHA512 2e8d9459d0b061443e0c6cc050e162fffcac4999dda98d225add96d62ec3a3d724d9b2846393a02fc128ccedbd85bc07d852055e30d9ccdfee4a03b991b5d406
TLSH
T181117A33F3CC8724DC9A403650CEED1036B6CBDB409EDE5BAB84D549B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

4j0hqex3.exe

Path C:\Users\Admin\AppData\Local\Temp\4j0hqex3.exe
Size 1.4MB
SHA256 81406a227a22e94e6faf85c7e940345bb22ba5a201895beea22e46ad3e9d37a3
MD5 798993d70a519d7c6a86114d90d2bc4e
SHA1 4141ee43a7926c224540ee64b92c3737a9d1ff0d
SHA512 1170637d0802d3cf634a408f0a3d930efb328653f4bc64f6ab2be4b002525eb0107f9b3e110cee50d33849a7b8cb82e328de02dc0fb6790aea80711bc0a97a17
SSDEEP 24576:QMQevMAeqhqbSj75JXcfl740p2R8d5FBsyrw46ugXuHZ:QMQevMAeqhqbSX5tGP5d5FBsyrLg
TLSH
T1CA654C67E2A344ECC56BC07486579F72AA70B85902387D7F1AD4DB312F22E604B6E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uewp0t1j.yyi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uewp0t1j.yyi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1772-28-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-23-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-33-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-32-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-31-0x0000026CFC9C0000-0x0000026CFCAEF000-memory.dmp

Download

memory/1772-29-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-27-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-26-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-25-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/1772-20-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/2124-38-0x0000019E9AF90000-0x0000019E9B0BF000-memory.dmp

Download

memory/3792-14-0x000002A37E8D0000-0x000002A37E8FA000-memory.dmp

Download

memory/3792-15-0x000002A37E8D0000-0x000002A37E8F4000-memory.dmp

Download

memory/3792-5-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/3792-18-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/3792-17-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/3792-7-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/3792-0-0x00007FFF17CEF000-0x00007FFF17CF0000-memory.dmp

Download

memory/3792-6-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/3792-13-0x000002A37E740000-0x000002A37E74A000-memory.dmp

Download

memory/3792-12-0x000002A37E680000-0x000002A37E732000-memory.dmp

Download

memory/3792-11-0x000002A37E660000-0x000002A37E67E000-memory.dmp

Download

memory/3792-4-0x000002A37E250000-0x000002A37E272000-memory.dmp

Download

memory/3792-8-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/3792-1-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download