Analysis
- max time kernel
144s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 17:21
General
- Target 2026-09-04_199579648325fcede3e554327a0d7287_elex_glassworm_mafia_remcos.exe
- Size 1.2MB
- Sample260905-vxcddaygkg
- SHA256 3ce0d2001b6068dcc4077c70dc7cbad31dea3dc6cddcccfbbb7e3321a470e524
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 18 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_199579648325fcede3e554327a0d7287_elex_glassworm_mafia_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_199579648325fcede3e554327a0d7287_elex_glassworm_mafia_remcos.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
wbengine.exe
memory/608-352-0x00007FF7681F0000-0x00007FF76847A000-memory.dmp
memory/608-353-0x0000016782E20000-0x0000016782E86000-memory.dmp
memory/608-354-0x0000016782E20000-0x0000016782E86000-memory.dmp
memory/1060-348-0x00007FF726740000-0x00007FF726A60000-memory.dmp
memory/1060-346-0x00000163A0010000-0x00000163A0076000-memory.dmp
memory/1060-341-0x00000163A0010000-0x00000163A0076000-memory.dmp
memory/1060-342-0x00000163A0010000-0x00000163A0076000-memory.dmp
memory/1412-371-0x000001D3EE740000-0x000001D3EE7A6000-memory.dmp
memory/1412-372-0x000001D3EE740000-0x000001D3EE7A6000-memory.dmp
memory/1412-370-0x00007FF6ABE60000-0x00007FF6AC366000-memory.dmp
memory/1984-315-0x0000021624260000-0x00000216242C6000-memory.dmp
memory/1984-314-0x0000021624260000-0x00000216242C6000-memory.dmp
memory/1984-313-0x00007FF760DA0000-0x00007FF760E53000-memory.dmp
memory/2056-366-0x00007FF7E2DC0000-0x00007FF7E3290000-memory.dmp
memory/2056-362-0x000001770BB60000-0x000001770BBC6000-memory.dmp
memory/2056-361-0x000001770BB60000-0x000001770BBC6000-memory.dmp
memory/2116-244-0x00007FF70B410000-0x00007FF70B4D8000-memory.dmp
memory/2116-248-0x0000028DE0970000-0x0000028DE09D6000-memory.dmp
memory/2116-249-0x0000028DE0970000-0x0000028DE09D6000-memory.dmp
memory/2116-322-0x00007FF70B410000-0x00007FF70B4D8000-memory.dmp
memory/2312-331-0x00007FF75F8B0000-0x00007FF75F9C9000-memory.dmp
memory/2312-254-0x000002E5672F0000-0x000002E567356000-memory.dmp
memory/2312-253-0x000002E5672F0000-0x000002E567356000-memory.dmp
memory/2312-247-0x00007FF75F8B0000-0x00007FF75F9C9000-memory.dmp
memory/3108-334-0x000001E524360000-0x000001E5243C6000-memory.dmp
memory/3108-332-0x00007FF62C270000-0x00007FF62C404000-memory.dmp
memory/3108-333-0x000001E524360000-0x000001E5243C6000-memory.dmp
memory/3256-266-0x00000225FB670000-0x00000225FB6D6000-memory.dmp
memory/3256-265-0x00000225FB670000-0x00000225FB6D6000-memory.dmp
memory/3256-261-0x00007FF71FDA0000-0x00007FF71FEE9000-memory.dmp
memory/3256-340-0x00007FF71FDA0000-0x00007FF71FEE9000-memory.dmp
memory/3316-6-0x0000000002C10000-0x0000000002C79000-memory.dmp
memory/3316-7-0x0000000002C10000-0x0000000002C79000-memory.dmp
memory/3316-0-0x0000000002B10000-0x0000000002BB4000-memory.dmp
memory/3316-1-0x0000000002C10000-0x0000000002C79000-memory.dmp
memory/3620-53-0x0000012DE61B0000-0x0000012DE6216000-memory.dmp
memory/3620-48-0x0000012DE61B0000-0x0000012DE6216000-memory.dmp
memory/3620-55-0x00007FF7A35D0000-0x00007FF7A3738000-memory.dmp
memory/3620-47-0x0000012DE61B0000-0x0000012DE6216000-memory.dmp
memory/3620-46-0x00007FF7A35D0000-0x00007FF7A3738000-memory.dmp
memory/4272-15-0x00007FF6EB840000-0x00007FF6EB962000-memory.dmp
memory/4272-16-0x000001C7AB950000-0x000001C7AB9B6000-memory.dmp
memory/4272-17-0x000001C7AB950000-0x000001C7AB9B6000-memory.dmp
memory/4272-19-0x000001C7AB950000-0x000001C7AB9B6000-memory.dmp
memory/4272-64-0x00007FF6EB840000-0x00007FF6EB962000-memory.dmp
memory/4600-30-0x0000019300580000-0x00000193005E6000-memory.dmp
memory/4600-28-0x0000019300410000-0x00000193004A5000-memory.dmp
memory/4600-31-0x0000019300580000-0x00000193005E6000-memory.dmp
memory/4600-29-0x0000019300580000-0x00000193005E6000-memory.dmp
memory/4608-273-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4608-274-0x0000000000920000-0x0000000000989000-memory.dmp
memory/4608-279-0x0000000000920000-0x0000000000989000-memory.dmp
memory/4608-351-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4752-367-0x00007FF60E360000-0x00007FF60E40D000-memory.dmp
memory/4752-295-0x000001E1AF770000-0x000001E1AF7D6000-memory.dmp
memory/4752-294-0x000001E1AF770000-0x000001E1AF7D6000-memory.dmp
memory/4752-293-0x00007FF60E360000-0x00007FF60E40D000-memory.dmp
memory/4876-304-0x000002AB20910000-0x000002AB20976000-memory.dmp
memory/4876-303-0x000002AB20910000-0x000002AB20976000-memory.dmp
memory/4876-302-0x00007FF620200000-0x00007FF620616000-memory.dmp
memory/5364-60-0x0000023CA14E0000-0x0000023CA1546000-memory.dmp
memory/5364-59-0x0000023CA14E0000-0x0000023CA1546000-memory.dmp
memory/5364-58-0x0000023CA1440000-0x0000023CA14D5000-memory.dmp
memory/5760-236-0x000001FFEA130000-0x000001FFEA196000-memory.dmp
memory/5760-312-0x00007FF70B410000-0x00007FF70B4D8000-memory.dmp
memory/5760-235-0x00007FF70B410000-0x00007FF70B4D8000-memory.dmp
memory/5760-237-0x000001FFEA130000-0x000001FFEA196000-memory.dmp
memory/5904-323-0x00007FF69A540000-0x00007FF69A7E3000-memory.dmp
memory/5904-325-0x000001991F020000-0x000001991F086000-memory.dmp
memory/5904-324-0x000001991F020000-0x000001991F086000-memory.dmp
memory/6024-360-0x00007FF69D240000-0x00007FF69D983000-memory.dmp
memory/6024-285-0x000002323D970000-0x000002323D9D6000-memory.dmp
memory/6024-287-0x00007FF69D240000-0x00007FF69D983000-memory.dmp
memory/6024-286-0x000002323D970000-0x000002323D9D6000-memory.dmp
memory/6040-38-0x00000234052A0000-0x0000023405306000-memory.dmp
memory/6040-39-0x00000234052A0000-0x0000023405306000-memory.dmp
memory/6040-37-0x00000234050E0000-0x0000023405175000-memory.dmp
memory/6040-40-0x00000234052A0000-0x0000023405306000-memory.dmp