10bec4ab0951184d58b80d3a6023ce57f31f2a3dabd7506d383c02bd41f45d44

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Size 7.0MB
Sample261014-e9fcssws3p
SHA256 10bec4ab0951184d58b80d3a6023ce57f31f2a3dabd7506d383c02bd41f45d44
MD5 d85a49c596444b24010cefd22ab96fe7
SHA1 e55e534ccfba7099fbec36cf415ba303a3a6d607
SHA512 b5e3637e51fcb0324f84b7060e78504d6c40bf2a310ad5e79b504166e48a4c96a5a920ed242bd00b8201923a6e110ce20702c9720b0739bde638040f7cefe4f1
SSDEEP 98304:RkXbYD5g3DP52Lfj+ENJ7WVkXEfZdoTyvXK:Hg92byCNeZMyvK
TLSH
T140767C66A66CC0B5D0A2C079C951D6E6E2B23C45DB304ADB21A2BE1E7E377D14C3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/1624-93-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1624-96-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral2/memory/1624-100-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/memory/1624-93-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/1624-147-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/1624-148-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/memory/1624-93-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 6 IoCs

pid	Process
4572	alg.exe
5800	GameInputSvc.exe
2956	GameInputSvc.exe
1276	elevation_service.exe
2980	maintenanceservice.exe
5964	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a3cef370e4fea11e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1624	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
1624	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
1624	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
1624	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
2956	GameInputSvc.exe
2956	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1624	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
Token: SeTcbPrivilege	5800	GameInputSvc.exe
Token: SeDebugPrivilege	4572	alg.exe
Token: SeDebugPrivilege	4572	alg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1624	2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 2956	5800	GameInputSvc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d85a49c596444b24010cefd22ab96fe7_glassworm_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 0128abddcfa1495f5dc8de4a59108e4e07afa8324128ebfdf7db66a7e45f728e
MD5 be541a6d3f802cbebdac6d1f8abf211b
SHA1 62eb4ba0dfb3edc98e9fb50d02c8e08f32aa354b
SHA512 1abb3d426b193bb4cd62b00327657b535180aeb152079059b3777d515ca6f00a191af4da0d8d0701c4b2533f915c6e6f15cadb2be906ea2ccc9ab1a3014dac2d
SSDEEP 24576:kXYjztczABAKcPY4Pv0N2ZAytOZd9DYW6NRvkRBqKRiRyZ:3tcCcdENuEZdxY1DvkRAEXZ
TLSH
T11D050125B3E509F9FC67827CC8A28402DA73B8554760E79F03E889694F637D85D3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 bd4077822fed00105896a34240f02c42ecd61f74dc6b81913b5b8446c7de3086
MD5 4f255ae98d6b3e789f6e26b256485416
SHA1 0cb5db14d9e565eb18b5c181e37feeefb0f9c970
SHA512 4673685dddbd4b41dfde329934a8d42b6965c4b6f8aae1b7660dee3883a46d3a8092b566f4bb102e1e890a608c018cd5c11fe2a4c1ed3ba4f613830b36b6f9ea
SSDEEP 24576:UwusOWCAKcPY4Pv0N2ZAytOZd9DYW6NRvkRBqKRiRy:UwfO1cdENuEZdxY1DvkRAEX
TLSH
T11205F14676A90CFAF5A7523C85978532EBF2B8112A31C72F03A4C64B5F63361BD2DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b58537128f4ab0181bc904ec9db80a6681b7fcf8bd1375ca21a5103dbc9e9c45
MD5 2207647358dd4bcea1d22af32058ae45
SHA1 58804926e4b6bd1b8d2edd319006dece5a990c51
SHA512 e4b5aa44e8fbd91c9d7cf446b33e26c1e240563806daf0778020aca35d8acd95fd9ca1f5e470a1fc704de4a526999c8e7d17d703c2c8b2778355954c12752b95
SSDEEP 49152:HB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl4cdENuEZdxY1DvkRAEXZ:Ju6JmTxd2dOZdoTyvXZ
TLSH
T1BBD5AE13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BIMx_Log.txt

Path C:\Users\Admin\Documents\BIMx\BIMx_Log.txt
Size 1KB
SHA256 8b0c2a71ada361c31f59a761829f4ed9b8aad8c857af2a944e7675ddc643a8a2
MD5 9e02e0f50f0d92609c6b3398050c9634
SHA1 5c48b3aebca19a2f25f3eef4885e011135a6d250
SHA512 c4daf7eb83a05196fbf778a6cf5a1f59c87bd9815db51ec75a6a5248dc9502a4c91a4022f030207370cf3ed722698a66c501feda68d4ace20efa6d6d8cc33f7c
TLSH
T18D217EF84968613E4B38D283D5B353162587D8578BC5D0773D74450CBE6288AEBB258B
MD5 SHA1 SHA512 TLSH

Submit Download

BIMx_Log.txt

Path C:\Users\Admin\Documents\BIMx\BIMx_Log.txt
Size 492B
SHA256 8d61e79e2b39e24086fe016d2db265ad82cffc20511af0df31ba60f6c051006f
MD5 44d0ab9573cf0ba48bfd3b4fce69acba
SHA1 de2058b5e4d29459ea08c393ba2b1e461e7d2504
SHA512 a8388254267a6045e87ccfe36a540c6a7ec8dc9393c5ffc5ab2c7333392db9cc28f539b4a3dd9534721902a51c78b427f68a800d82b5d9efeb3ad7203a42d811
TLSH
T1FFF05990859D983F8030E28346A5661C62A65DCB6F8822697B208E1C6421897F7C2A42
MD5 SHA1 SHA512 TLSH

Submit Download

BIMx_Log.txt

Path C:\Users\Admin\Documents\BIMx\BIMx_Log.txt
Size 797B
SHA256 99b5bceec8d7a88dde8226f60efa492537f7b2e788f84d364eb4334dc4d68623
MD5 f48d6510f9b661e8fd70df074b2b1975
SHA1 64595262d02dd02711c388cb81aaa03380fd1711
SHA512 f5844415a1ed6f837dc74c43424b87eee0a6e69cbfe04336fb1414cd72ce5f7f79a273ca9b96c8cfab58a4cb72a097e29bf1e0a80de7ebfd5269d243ce467e26
TLSH
T1BF01C2A045BCA53F5131D2C35562E31812969C8A5EC455553E64CA0CFC10C8FE7D3A4E
MD5 SHA1 SHA512 TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 4614ae53fadccf3809189dbe02cf09ee82366ccae02050f002894627fde9cc85
MD5 3e2f49cdbd7ed05c5ddd02b643cfb86f
SHA1 b8bf1ff38bd58b55e6607540b9c1e19cb06443ae
SHA512 8bb06dccf9f5db9c33a6fe6e70d8104e6e95febb3a832bb88d84e79c1d2b45578e25eaf8a81a47fe991ccff4d04d5c97f68d489f3d9e3956d7ba4e17e788aa84
SSDEEP 12288:l2GqAKncPGHv3IPv2TNU2o0oAy/VOZNzvOsCIYW6NRvkRBXaKRIBRySqyq:gGqAKcPY4Pv0N2ZAytOZd9DYW6NRvkRx
TLSH
T192E41226A5BF69D6F076977C80A51803ADB2B870173146FF02D845B9CBE6EE0B03DD85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 36139f2f2e1d5217997b2cabc9ca73fa5ffeff3cd13380c426250e9352824855
MD5 838437feb16e30a3ecbd06970124e291
SHA1 86f4668e9c4573a53d67606700a2a53d7889d213
SHA512 036c0fe01d01d1ad34fcafde1048c002f8724ca2afd3a34ece2fe2e84f7722e5ee613ad3b10f60d4f03e4cde018667cb37c44c4eca773b27ec21b1a9baa9ba38
SSDEEP 24576:E6DI0AKcPY4Pv0N2ZAytOZd9DYW6NRvkRBqKRiRyZ:E6DIscdENuEZdxY1DvkRAEXZ
TLSH
T19EF4F11D637B11F6E077913D81820502D6B2B47587625AEF06D885BE8FE3ED8B83DE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6608eee87d78f92ebf9e63edaba2458071f3cae26ffeffe8407956a286327f6f
MD5 0efc13fcf62564e6388eb8c2c4bcb425
SHA1 3af184bc937afed801f601d1be214fb101b9dd90
SHA512 25f5c0072fb3caba0c85f840f9eca6eef21015684bfa50e491add79656d45274d8d500a985f8a40a506514c0ddbd98d7be34831ad6c84c254405ebed24c5daba
SSDEEP 24576:iTkNvNnaFeYhJNtmZBmzAKcPY4Pv0N2ZAytOZd9DYW6NRvkRBqKRiRyZ:iTMwBtOmFcdENuEZdxY1DvkRAEXZ
TLSH
T1B955AF2EB6B846E4E1FAC6B4CD238512EA727461073293CB5390C13F4E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-75-0x0000024763190000-0x00000247632E0000-memory.dmp

Download

memory/1276-76-0x00000247633B0000-0x0000024763416000-memory.dmp

Download

memory/1276-77-0x00000247633B0000-0x0000024763416000-memory.dmp

Download

memory/1624-95-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-144-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-189-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-188-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-43-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-0-0x0000000002BB0000-0x0000000002C16000-memory.dmp

Download

memory/1624-49-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-53-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-6-0x0000000002BB0000-0x0000000002C16000-memory.dmp

Download

memory/1624-154-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-58-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-59-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-60-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-61-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-62-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-63-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-64-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-65-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-66-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-67-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-68-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-69-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-115-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-152-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-150-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-78-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-82-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-39-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-84-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-85-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-101-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-31-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-87-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-88-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-89-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-90-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-91-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-92-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-93-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-94-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-28-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-96-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-97-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-99-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-98-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-100-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-86-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-126-0x0000000002BB0000-0x0000000002C16000-memory.dmp

Download

memory/1624-72-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-116-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-118-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-123-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-23-0x00007FF6AC3CC000-0x00007FF6AC3CD000-memory.dmp

Download

memory/1624-131-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-8-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-125-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-132-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-133-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-134-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-124-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-135-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-137-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-139-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-140-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-141-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-138-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-73-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-71-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-142-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-143-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-148-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-145-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/1624-147-0x00007FF6ABEF0000-0x00007FF6AD288000-memory.dmp

Download

memory/2956-156-0x00007FF7249C0000-0x00007FF724A88000-memory.dmp

Download

memory/2956-52-0x000002ABC9EB0000-0x000002ABC9F16000-memory.dmp

Download

memory/2956-191-0x00007FF7249C0000-0x00007FF724A88000-memory.dmp

Download

memory/2956-54-0x000002ABC9EB0000-0x000002ABC9F16000-memory.dmp

Download

memory/2980-160-0x00007FF6EC310000-0x00007FF6EC478000-memory.dmp

Download

memory/2980-162-0x0000018B667C0000-0x0000018B66826000-memory.dmp

Download

memory/2980-161-0x0000018B667C0000-0x0000018B66826000-memory.dmp

Download

memory/2980-169-0x00007FF6EC310000-0x00007FF6EC478000-memory.dmp

Download

memory/2980-167-0x0000018B667C0000-0x0000018B66826000-memory.dmp

Download

memory/4572-16-0x000002B2C0280000-0x000002B2C02E6000-memory.dmp

Download

memory/4572-18-0x000002B2C0280000-0x000002B2C02E6000-memory.dmp

Download

memory/4572-187-0x00007FF6DFBA0000-0x00007FF6DFCC2000-memory.dmp

Download

memory/4572-17-0x000002B2C0280000-0x000002B2C02E6000-memory.dmp

Download

memory/4572-15-0x00007FF6DFBA0000-0x00007FF6DFCC2000-memory.dmp

Download

memory/5800-155-0x00007FF7249C0000-0x00007FF724A88000-memory.dmp

Download

memory/5800-44-0x000001FD6BD60000-0x000001FD6BDC6000-memory.dmp

Download

memory/5800-45-0x000001FD6BD60000-0x000001FD6BDC6000-memory.dmp

Download

memory/5800-190-0x00007FF7249C0000-0x00007FF724A88000-memory.dmp

Download

memory/5964-173-0x000001DA19A70000-0x000001DA19AD6000-memory.dmp

Download

memory/5964-174-0x000001DA19A70000-0x000001DA19AD6000-memory.dmp

Download

memory/5964-172-0x000001DA19800000-0x000001DA19950000-memory.dmp

Download