Analysis
- max time kernel
146s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
16/08/2026, 03:21
General
- Target 2026-08-16_fd5f1a51053f1a6758d02b48f992dd31_elex_glassworm_mafia_remcos.exe
- Size 1.2MB
- Sample260816-dwecxaydle
- SHA256 fac1649dc056ccdaaa53eae935770c16a5918868f381c78c2cc7dd7e6506aaf5
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 19 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_fd5f1a51053f1a6758d02b48f992dd31_elex_glassworm_mafia_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_fd5f1a51053f1a6758d02b48f992dd31_elex_glassworm_mafia_remcos.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
wbengine.exe
memory/828-345-0x00007FF7E5F40000-0x00007FF7E60D4000-memory.dmp
memory/828-346-0x0000021619960000-0x00000216199C6000-memory.dmp
memory/828-347-0x0000021619960000-0x00000216199C6000-memory.dmp
memory/1040-40-0x0000022EEC740000-0x0000022EEC7A6000-memory.dmp
memory/1040-38-0x0000022EEC740000-0x0000022EEC7A6000-memory.dmp
memory/1040-39-0x0000022EEC740000-0x0000022EEC7A6000-memory.dmp
memory/1040-37-0x0000022EEC560000-0x0000022EEC613000-memory.dmp
memory/1116-279-0x0000018282E40000-0x0000018282EA6000-memory.dmp
memory/1116-280-0x0000018282E40000-0x0000018282EA6000-memory.dmp
memory/1116-277-0x00007FF761290000-0x00007FF7613D9000-memory.dmp
memory/1116-364-0x00007FF761290000-0x00007FF7613D9000-memory.dmp
memory/1196-59-0x00000207E4D50000-0x00000207E4DB6000-memory.dmp
memory/1196-60-0x00000207E4D50000-0x00000207E4DB6000-memory.dmp
memory/1196-58-0x00000207E4B40000-0x00000207E4BF3000-memory.dmp
memory/1284-375-0x00000214C3B40000-0x00000214C3BA6000-memory.dmp
memory/1284-376-0x00000214C3B40000-0x00000214C3BA6000-memory.dmp
memory/1284-374-0x00007FF64ABF0000-0x00007FF64B0C0000-memory.dmp
memory/1484-308-0x00000151D6810000-0x00000151D6876000-memory.dmp
memory/1484-306-0x00007FF6FF030000-0x00007FF6FF0DD000-memory.dmp
memory/1484-307-0x00000151D6810000-0x00000151D6876000-memory.dmp
memory/1648-55-0x00007FF74E520000-0x00007FF74E688000-memory.dmp
memory/1648-46-0x0000027056130000-0x0000027056196000-memory.dmp
memory/1648-53-0x0000027056130000-0x0000027056196000-memory.dmp
memory/1648-48-0x0000027056130000-0x0000027056196000-memory.dmp
memory/1648-47-0x00007FF74E520000-0x00007FF74E688000-memory.dmp
memory/1936-315-0x0000022FED970000-0x0000022FED9D6000-memory.dmp
memory/1936-320-0x00007FF6299D0000-0x00007FF629DE6000-memory.dmp
memory/1936-316-0x0000022FED970000-0x0000022FED9D6000-memory.dmp
memory/2768-327-0x000001AD85820000-0x000001AD85886000-memory.dmp
memory/2768-326-0x000001AD85820000-0x000001AD85886000-memory.dmp
memory/2768-325-0x00007FF6F98B0000-0x00007FF6F9963000-memory.dmp
memory/2796-335-0x00007FF6E77E0000-0x00007FF6E7A83000-memory.dmp
memory/2796-336-0x0000025537400000-0x0000025537466000-memory.dmp
memory/2796-337-0x0000025537400000-0x0000025537466000-memory.dmp
memory/3036-298-0x00007FF7AA160000-0x00007FF7AA8A3000-memory.dmp
memory/3036-300-0x0000026D63A00000-0x0000026D63A66000-memory.dmp
memory/3036-299-0x0000026D63A00000-0x0000026D63A66000-memory.dmp
memory/3036-388-0x00007FF7AA160000-0x00007FF7AA8A3000-memory.dmp
memory/3080-382-0x00007FF746660000-0x00007FF746B66000-memory.dmp
memory/3080-384-0x000001FA2AF30000-0x000001FA2AF96000-memory.dmp
memory/3080-383-0x000001FA2AF30000-0x000001FA2AF96000-memory.dmp
memory/4164-248-0x00007FF79BF60000-0x00007FF79C028000-memory.dmp
memory/4164-249-0x0000022C1A430000-0x0000022C1A496000-memory.dmp
memory/4164-250-0x0000022C1A430000-0x0000022C1A496000-memory.dmp
memory/4164-333-0x00007FF79BF60000-0x00007FF79C028000-memory.dmp
memory/4528-258-0x000001BF815E0000-0x000001BF81646000-memory.dmp
memory/4528-257-0x00007FF79BF60000-0x00007FF79C028000-memory.dmp
memory/4528-259-0x000001BF815E0000-0x000001BF81646000-memory.dmp
memory/4528-344-0x00007FF79BF60000-0x00007FF79C028000-memory.dmp
memory/4636-366-0x0000019A72680000-0x0000019A726E6000-memory.dmp
memory/4636-367-0x0000019A72680000-0x0000019A726E6000-memory.dmp
memory/4636-365-0x00007FF79F530000-0x00007FF79F7BA000-memory.dmp
memory/4676-373-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4676-287-0x00000000009F0000-0x0000000000A59000-memory.dmp
memory/4676-286-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4676-292-0x00000000009F0000-0x0000000000A59000-memory.dmp
memory/5036-64-0x00007FF76F4E0000-0x00007FF76F602000-memory.dmp
memory/5036-16-0x00000169F1EB0000-0x00000169F1F16000-memory.dmp
memory/5036-15-0x00007FF76F4E0000-0x00007FF76F602000-memory.dmp
memory/5036-17-0x00000169F1EB0000-0x00000169F1F16000-memory.dmp
memory/5036-18-0x00000169F1EB0000-0x00000169F1F16000-memory.dmp
memory/5236-28-0x000001B652510000-0x000001B6525C3000-memory.dmp
memory/5236-31-0x000001B652620000-0x000001B652686000-memory.dmp
memory/5236-29-0x000001B652620000-0x000001B652686000-memory.dmp
memory/5236-30-0x000001B652620000-0x000001B652686000-memory.dmp
memory/5236-71-0x000001B651DF0000-0x000001B652031000-memory.dmp
memory/5336-265-0x00007FF701530000-0x00007FF701649000-memory.dmp
memory/5336-266-0x0000013881B70000-0x0000013881BD6000-memory.dmp
memory/5336-353-0x00007FF701530000-0x00007FF701649000-memory.dmp
memory/5336-267-0x0000013881B70000-0x0000013881BD6000-memory.dmp
memory/5368-355-0x000002CF2E1C0000-0x000002CF2E226000-memory.dmp
memory/5368-359-0x00007FF7D8530000-0x00007FF7D8850000-memory.dmp
memory/5368-360-0x000002CF2E1C0000-0x000002CF2E226000-memory.dmp
memory/5368-354-0x000002CF2E1C0000-0x000002CF2E226000-memory.dmp
memory/6124-6-0x0000000002A30000-0x0000000002A99000-memory.dmp
memory/6124-7-0x0000000002A30000-0x0000000002A99000-memory.dmp
memory/6124-1-0x0000000002A30000-0x0000000002A99000-memory.dmp
memory/6124-0-0x0000000002B00000-0x0000000002BF6000-memory.dmp