Overview

overview

6

Static

static

3

2026-09-01...ee.exe

windows10-2004-x64

6

2026-09-01...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    136s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/09/2026, 11:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-01_57e90959321f844c729fea2b84ca22d1_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
  • Size 2.1MB
  • Sample260903-nwaptsssdz
  • SHA256 57a1ba6009ca646e6063b1f82c2c6ba36966108ac608cf417519fb345cda6dd5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 34 IoCs
  • Drops file in Windows directory 56 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-01_57e90959321f844c729fea2b84ca22d1_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-01_57e90959321f844c729fea2b84ca22d1_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2976
  • C:\Users\Admin\AppData\Local\Temp\2026-09-01_57e90959321f844c729fea2b84ca22d1_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-01_57e90959321f844c729fea2b84ca22d1_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:5884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Adapterlibcef.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Adapterlibcef.exe
        • Size 9.6MB
        • SHA256 79b5b48ffc6b1b06551e5838740b724df48d4dd8e5aafee41c29f285bbbcfbc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DynamicProjection.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DynamicProjection.exe
        • Size 2.1MB
        • SHA256 b9abb14da2793e2322ab658b4bad3de1852cfade7fbab5e6339114707c783294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ccmebaseDynamic.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccmebaseDynamic.exe
        • Size 2.1MB
        • SHA256 ae99874f211213873dd902a557794f085deb49e963898bc2231cd0bd6a4238df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcrobatAdobeARM.exe
        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AcrobatAdobeARM.exe
        • Size 2.5MB
        • SHA256 72c17af6ede64537d07195fd69a3daf34dbe3205bbcf592425259b4789fefa1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Windowssqloledb10.0.26100.1.160101.0800.exe
        • Path C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\Windowssqloledb10.0.26100.1.160101.0800.exe
        • Size 2.1MB
        • SHA256 8a2a9765e527782535d22d73e9c997891be9daca4d4d967564ae9aae40104857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdaterUpdater.exe
        • Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\UpdaterUpdater.exe
        • Size 2.7MB
        • SHA256 1151dc69f9f8650871de70592afb1a0a48098bb2652440c76834eab604ea273e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iexploreieinstal11.00.26100.1.exe
        • Path C:\Program Files (x86)\Internet Explorer\it-IT\iexploreieinstal11.00.26100.1.exe
        • Size 2.1MB
        • SHA256 8282ed9246e2fd52e7d142652005ba8da0c410bfa1d6cb195e29cd6325d3bc12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EdgeMicrosoft.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\x64\EdgeMicrosoft.exe
        • Size 2.1MB
        • SHA256 54eb61b49340a90abd30dc1982c0b00327851e64831c54f3614fdf707a102569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsMicrosoft.exe
        • Path C:\Program Files (x86)\Windows NT\TableTextService\WindowsMicrosoft.exe
        • Size 2.1MB
        • SHA256 57a1ba6009ca646e6063b1f82c2c6ba36966108ac608cf417519fb345cda6dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Securityresources.exe
        • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\Securityresources.exe
        • Size 2.2MB
        • SHA256 7852d9d7550011b57f9517340f7740d1ebab83088856b41b3293c152e2fe8c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resourcesmscorrc.exe
        • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\resourcesmscorrc.exe
        • Size 2.2MB
        • SHA256 68877b445bf83ed5ea859d246e2e608b99cb3844bc9dc6c3eb714f1c98796cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download