Analysis
- max time kernel
151s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 23:25
General
- Target 2026-09-09_cb3cf57a11d4f178feb0fc47fbf09947_agent-tesla_dcrat_elex_glassworm_hijackloader_icedid_quasar-rat_remcos.exe
- Size 59.7MB
- Sample260910-3eepsay1hx
- SHA256 ded027733d0af3476cccc548573c89f095c2448d5d3ad546558d583b0efdc313
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Drops file in Windows directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with taskkill 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_cb3cf57a11d4f178feb0fc47fbf09947_agent-tesla_dcrat_elex_glassworm_hijackloader_icedid_quasar-rat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_cb3cf57a11d4f178feb0fc47fbf09947_agent-tesla_dcrat_elex_glassworm_hijackloader_icedid_quasar-rat_remcos.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wT7iPhnS4czs.exe"C:\Users\Admin\AppData\Local\Temp\wT7iPhnS4czs.exe" --run2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update_2c9181fd2bf54aa3ac77fb014c6c8d26.bat" "3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yp3otixzb95mfh.exe"C:\Users\Admin\AppData\Local\Temp\yp3otixzb95mfh.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bZWT9YJ5oUZ.exe"C:\Users\Admin\AppData\Local\Temp\bZWT9YJ5oUZ.exe" --run5⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "wT7iPhnS4czs.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
update_2c9181fd2bf54aa3ac77fb014c6c8d26.bat
x9oqi4n4s4jaog.bin
memory/3932-84-0x000002018E8C0000-0x000002019249E000-memory.dmp
memory/4856-0-0x00007FFBC9FEF000-0x00007FFBC9FF0000-memory.dmp
memory/4856-1-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-2-0x000001F72A6A0000-0x000001F72E256000-memory.dmp
memory/4856-3-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-4-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-5-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-6-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-7-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-8-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-9-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-10-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-11-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-12-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-14-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-15-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-16-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-13-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-18-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-21-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/4856-22-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-24-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-36-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-23-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-19-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-25-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-27-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-26-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-28-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-29-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-30-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-31-0x000001D9D4340000-0x000001D9D4554000-memory.dmp
memory/5512-32-0x000001D9D4BC0000-0x000001D9D4BD2000-memory.dmp
memory/5512-33-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-34-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-35-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-20-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-37-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-38-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-39-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-40-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-41-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-42-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-43-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-44-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-45-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp
memory/5512-46-0x000001D9D6360000-0x000001D9D6382000-memory.dmp
memory/5512-47-0x000001D9D8150000-0x000001D9D818C000-memory.dmp
memory/5512-48-0x000001D9D90A0000-0x000001D9D9152000-memory.dmp
memory/5512-64-0x000001D9D6390000-0x000001D9D63A2000-memory.dmp
memory/5512-65-0x000001D9DB050000-0x000001D9DB0D8000-memory.dmp
memory/5512-66-0x000001D9D8130000-0x000001D9D813A000-memory.dmp
memory/5512-82-0x00007FFBC9E60000-0x00007FFBCA804000-memory.dmp