771b3848da76d728b73e34da318dd8330ee9ebe7a71b0dc96924c59f52e23de1

General

Target
2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe
Size 13.7MB
Sample260804-dp2vmafk6z
SHA256 771b3848da76d728b73e34da318dd8330ee9ebe7a71b0dc96924c59f52e23de1
MD5 263d8eb98f3500eb2c2dca4716f151ae
SHA1 910cbe0b057e785eba73a45bd2f8d7614b2b1e55
SHA512 977f7605b630b3f6a2870f0ea4a84a8e5e93bd55135ecce91f04c5c59915e5c51a3075ef406192a77004921c900d4a684ea49c2a9920c728a60b9ac28b8dcd8f
SSDEEP 196608:YXYQeNcfBa2JnwwzOn0RZpiOY7aR5zvXlkTWMYoYGCYV8DERF/+:Yicxv5R1vcvYw8DuI
TLSH
T17CE66C34D233EA7AD6771538543A63369AA8FA34073051CFAACD3D23986D6C14D722B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c55f-9.dat	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Detects executables potentially checking for WinJail sandbox window 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c55f-9.dat	INDICATOR_SUSPICIOUS_EXE_Anti_WinJail

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c55f-9.dat	UPX

Executes dropped EXE 3 IoCs

pid	Process
4112	svchost.exe
700	2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe
5388	svchost.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4112	3580	2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe	89
PID 4112 wrote to memory of 700	4112	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:700

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_263d8eb98f3500eb2c2dca4716f151ae_elex_glassworm_jeefo_stop.exe
Size 13.7MB
SHA256 5127713e23a6eec8252c05e24989933d1c1b0074dd63a6d787ed39b073b6cbdd
MD5 b7b717ba70157d9a2a94478704711478
SHA1 bfe6badd4682c8dd100ccc34c2292a2989bcbcdb
SHA512 d5755ff33644ea939c239f7c4e57c5267153de33ea721185ae11f9e0ed538946a6be8ed810abd7c7021866a12768c5339d42bde1878634e98561010a48529f12
SSDEEP 196608:aXYQeNcfBa2JnwwzOn0RZpiOY7aR5zvXlkTWMYoYGCYV8DE9:aicxv5R1vcvYw8Du
TLSH
T17FE66B34D233DA7AE6771538543A63369AA8FA34073051CFAACD3D23986D6C14D722B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 35KB
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
SSDEEP 768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j
TLSH
T122F2F72B5491EC7AC8A212F026BD0F26C376C9B0B854E58ADBC42D6B75A11D2F1B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4112-12-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5388-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5388-25-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads