Overview

overview

6

Static

static

3

2026-08-22...ee.exe

windows10-2004-x64

6

2026-08-22...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    136s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 23:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_d1ba66b73122c33a9843d6379d268709_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.4MB
  • Sample260822-3vb9la1bmc
  • SHA256 a2bb5cedb5e830408bc77d9041c6b3841c6d237e6e774f3bea355aa1e82be6e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 45 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_d1ba66b73122c33a9843d6379d268709_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_d1ba66b73122c33a9843d6379d268709_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2672
  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_d1ba66b73122c33a9843d6379d268709_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-22_d1ba66b73122c33a9843d6379d268709_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        libceficudt60.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libceficudt60.exe
        • Size 1.4MB
        • SHA256 94c633ed1aa0ba42a4130b6cc122a2789290ea07feb43216c29e959d81c17101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeNPPDF32.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\AdobeNPPDF32.exe
        • Size 1.4MB
        • SHA256 f981a132918c3bc57c4db4bff68f6a2fd0262c9736c834babf965ad7081bd29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCChromeNativeMessagingHostCreate.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHostCreate.exe
        • Size 1.5MB
        • SHA256 92a7e2a27cf114e9230061141a30015539c6772d0bfed655bde270b7adeff06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DirectInkUnicode.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInkUnicode.exe
        • Size 1.4MB
        • SHA256 d394d81a45300d7582154bcfe7e57fcb7db2ea2e303da1f3941723aafed7475c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqliteProjection.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqliteProjection.exe
        • Size 2.1MB
        • SHA256 ca290a8803257f509b4b332125860d12a389fafbf46d5e3701071cc36e78aaf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeReader.exe
        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeReader.exe
        • Size 1.5MB
        • SHA256 f2c4b058a7b84115a3c7eb4879a131b74f545dd8e8b2738733a19eed2b8a3029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlxmlxWindows.exe
        • Path C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlxWindows.exe
        • Size 1.4MB
        • SHA256 a2bb5cedb5e830408bc77d9041c6b3841c6d237e6e774f3bea355aa1e82be6e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ieinstalHMMAPI.exe
        • Path C:\Program Files (x86)\Internet Explorer\en-US\ieinstalHMMAPI.exe
        • Size 1.4MB
        • SHA256 aa118991c1891d54bc2ca95cd9ce278469cf7a4686407e5daa2a3684f783db27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Utilitiesvcruntime1401.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Utilitiesvcruntime1401.exe
        • Size 1.5MB
        • SHA256 80a2b98b23ac090d336337cdf0fe9c4a6a0b9a6a8a6fcc816bff20cd8bfefe62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftMicrosoft.exe
        • Path C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MicrosoftMicrosoft.exe
        • Size 1.4MB
        • SHA256 52a410de465cb988f1816cd211d883aa5ef99e6ed0f8765ae35b708281ee3709
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download