Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 09:14

General

  • Target
    2026-10-10_881bb1ac8a5f4f0be3c86867a331d269_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
  • Size 6.8MB
  • Sample261011-k7amesyxft
  • SHA256 354db5b237b7f06e8ec3b10831795f04e6fc3dc7baac6a94b64cd2caf10a3fc8
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 19 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 61 IoCs
  • Modifies registry class 32 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_881bb1ac8a5f4f0be3c86867a331d269_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_881bb1ac8a5f4f0be3c86867a331d269_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\9dcc7281c44a8c11\ScreenConnect.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3400
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 01B4E7400AD61466B6F6044927C502A0 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI69CC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740937 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2332
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2044
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 8780D71BFE2A6AE53754BD648791B1A9
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1600
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users','C:\Windows\Temp','C:\Windows','C:\ProgramData','C:\Program Files (x86)' -Force"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2524
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "try{Invoke-CimMethod -ClassName MSFT_MpPreference -Method Add -Namespace root/Microsoft/Windows/Defender -Arguments @{ExclusionPath=@('C:\','C:\Users','C:\Windows\Temp','C:\Windows','C:\ProgramData','C:\Program Files (x86)');Force=$True} -ErrorAction SilentlyContinue}catch{}"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4180
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3946DEF9E8C0F050B7B87080A8C18647 E Global\MSI0000
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3212
        • C:\ProgramData\SysMgr\WinUpdate.exe
          "C:\ProgramData\SysMgr\WinUpdate.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1020
          • C:\Windows\Temp\WinUpdate.exe
            "C:\Windows\Temp\WinUpdate.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4084
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /Create /F /SC ONSTART /TN "AppDataCacheService" /TR "\"C:\Windows\Temp\WinUpdate.exe\"" /RU SYSTEM /RL HIGHEST
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1740
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /Create /F /SC ONLOGON /TN "AppDataCacheMonitor" /TR "\"C:\Windows\Temp\WinUpdate.exe\"" /RU SYSTEM /RL HIGHEST
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2400
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-457f.bat"
            4⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4256
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 3
              5⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5360
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /F /SC ONSTART /TN "AppDataCacheService" /TR "\"C:\ProgramData\SysMgr\WinUpdate.exe\"" /RU SYSTEM /RL HIGHEST
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:548
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /F /SC ONLOGON /TN "AppDataCacheMonitor" /TR "\"C:\ProgramData\SysMgr\WinUpdate.exe\"" /RU SYSTEM /RL HIGHEST
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2876
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2104
    • C:\Windows\Temp\WinUpdate.exe
      "C:\Windows\Temp\WinUpdate.exe"
      1⤵
      • Executes dropped EXE
      PID:2340
    • C:\ProgramData\SysMgr\WinUpdate.exe
      "C:\ProgramData\SysMgr\WinUpdate.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\Temp\WinUpdate.exe
        "C:\Windows\Temp\WinUpdate.exe"
        2⤵
        • Executes dropped EXE
        PID:2460
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-711d.bat"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3160
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1 -n 3
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5932
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /Create /F /SC ONSTART /TN "AppDataCacheService" /TR "\"C:\ProgramData\SysMgr\WinUpdate.exe\"" /RU SYSTEM /RL HIGHEST
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3500
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /Create /F /SC ONLOGON /TN "AppDataCacheMonitor" /TR "\"C:\ProgramData\SysMgr\WinUpdate.exe\"" /RU SYSTEM /RL HIGHEST
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4464

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59b58c.rbs

          • Path C:\Config.Msi\e59b58c.rbs
          • Size 10KB
          • SHA256 2e312a49f5b55eb3b4ecddba5bbe33a12cde1e4a4e08ca3f9b6e3230530b973c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinUpdate.exe

          • Path C:\ProgramData\SysMgr\WinUpdate.exe
          • Size 1.1MB
          • SHA256 7a195b536b6159d66a57a16cb4a335f8c541e51e2f67c4aa6817959052e03908
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Admin_FontCacheLayout.dat

          • Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Admin_FontCacheLayout.dat
          • Size 217B
          • SHA256 b29d70518f52b054c960727829097aa9ea036596493fbf7d5ac53e9b0b1686ed
          • MD5 SHA1 SHA512 TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 26b1f15ea6276bfdb3b0d8cced19f642f4883613437883451405f76dcd5eee90
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MSI69CC.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\MSI69CC.tmp
          • Size 1.0MB
          • SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Microsoft.Deployment.WindowsInstaller.dll

          • Path C:\Users\Admin\AppData\Local\Temp\MSI69CC.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ScreenConnect.Core.dll

          • Path C:\Users\Admin\AppData\Local\Temp\MSI69CC.tmp-\ScreenConnect.Core.dll
          • Size 538KB
          • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ScreenConnect.InstallerActions.dll

          • Path C:\Users\Admin\AppData\Local\Temp\MSI69CC.tmp-\ScreenConnect.InstallerActions.dll
          • Size 11KB
          • SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ScreenConnect.Windows.dll

          • Path C:\Users\Admin\AppData\Local\Temp\MSI69CC.tmp-\ScreenConnect.Windows.dll
          • Size 1.6MB
          • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ScreenConnect.ClientSetup.msi

          • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\9dcc7281c44a8c11\ScreenConnect.ClientSetup.msi
          • Size 10.9MB
          • SHA256 1e7b4edf96a247473b352a4ca4f3eb6285e52b766c9a155dc6c9b2a4ee55f9af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          __PSScriptPolicyTest_5ifwiwul.gtj.psm1

          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ifwiwul.gtj.psm1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH

          tmp-457f.bat

          • Path C:\Users\Admin\AppData\Local\Temp\tmp-457f.bat
          • Size 149B
          • SHA256 6df032dc1a3efe5ba3cc2b65a304738fc74739a3233314a2444d8b6402ecec7a
          • MD5 SHA1 SHA512 TLSH

          tmp-711d.bat

          • Path C:\Users\Admin\AppData\Local\Temp\tmp-711d.bat
          • Size 149B
          • SHA256 68acffade5ede4707ab8e2a6d015823b5d57212efa43f45f5105522e6887ec69
          • MD5 SHA1 SHA512 TLSH

          MSIDDD4.tmp

          • Path C:\Windows\Installer\MSIDDD4.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH

          metadata-2

          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 851fa2b9aedddc7816b0920eb291a51d1541b24eba99addf2f334993102813e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          {8d9ff593-7835-4cb1-ae19-c110ecbe3519}_OnDiskSnapshotProp

          • Path \??\Volume{d1fc2eb0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8d9ff593-7835-4cb1-ae19-c110ecbe3519}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 487cdbb630102a38e1b8810248ffcd8824104f5599bfa621deafbe0b3896e313
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/2332-32-0x00000000034F0000-0x000000000351E000-memory.dmp

          memory/2332-36-0x0000000002680000-0x000000000268A000-memory.dmp

          memory/2332-40-0x0000000005610000-0x000000000569C000-memory.dmp

          memory/2332-44-0x0000000005990000-0x0000000005B3C000-memory.dmp

          memory/2448-54-0x000001D715F10000-0x000001D7168B4000-memory.dmp

          memory/2524-58-0x0000000006270000-0x00000000062D6000-memory.dmp

          memory/2524-73-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

          memory/2524-55-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

          memory/2524-56-0x0000000005C20000-0x000000000626A000-memory.dmp

          memory/2524-57-0x0000000005B70000-0x0000000005B92000-memory.dmp

          memory/2524-74-0x0000000007DE0000-0x0000000007E76000-memory.dmp

          memory/2524-59-0x00000000062E0000-0x0000000006346000-memory.dmp

          memory/2524-60-0x0000000006350000-0x00000000066AB000-memory.dmp

          memory/2524-63-0x0000000006830000-0x000000000684E000-memory.dmp

          memory/2524-64-0x0000000006870000-0x00000000068BC000-memory.dmp

          memory/2524-65-0x00000000079D0000-0x0000000007A06000-memory.dmp

          memory/2524-72-0x0000000007B70000-0x0000000007B8A000-memory.dmp

          memory/2524-66-0x0000000072280000-0x00000000722CC000-memory.dmp

          memory/2524-69-0x0000000006DC0000-0x0000000006DE0000-memory.dmp

          memory/2524-70-0x0000000007A10000-0x0000000007AB3000-memory.dmp

          memory/2524-71-0x00000000081B0000-0x000000000882C000-memory.dmp

          memory/4084-132-0x0000000180000000-0x0000000180058000-memory.dmp

          memory/4180-82-0x0000000007540000-0x000000000756A000-memory.dmp

          memory/4180-84-0x00000000723E0000-0x000000007273B000-memory.dmp

          memory/4180-83-0x0000000007570000-0x0000000007594000-memory.dmp

          memory/4180-79-0x0000000072280000-0x00000000722CC000-memory.dmp

          memory/4864-7-0x0000000005AF0000-0x00000000060AA000-memory.dmp

          memory/4864-9-0x0000000074940000-0x00000000750FC000-memory.dmp

          memory/4864-0-0x0000000074952000-0x0000000074953000-memory.dmp

          memory/4864-10-0x0000000074940000-0x00000000750FC000-memory.dmp

          memory/4864-8-0x0000000074940000-0x00000000750FC000-memory.dmp

          memory/4864-6-0x00000000053B0000-0x000000000555C000-memory.dmp

          memory/4864-5-0x0000000074940000-0x00000000750FC000-memory.dmp

          memory/4864-4-0x0000000002D70000-0x0000000002D92000-memory.dmp

          memory/4864-3-0x0000000005320000-0x00000000053AC000-memory.dmp

          memory/4864-2-0x0000000005690000-0x0000000005AF2000-memory.dmp

          memory/4864-13-0x0000000074940000-0x00000000750FC000-memory.dmp

          memory/4864-1-0x0000000001310000-0x0000000001318000-memory.dmp