Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 23:24
General
- Target 2026-10-27_e9d055ab05bce613433cd5e870b72b4a_elex_glassworm_icedid_njrat_remcos.exe
- Size 8.8MB
- Sample261027-3d482sxvcx
- SHA256 149aec6092bcd0be8bf9fec9ecf68df83af92f50e58330096e57b713a4ec1e63
Score
9/10
Malware Config
Signatures
- Detects executables referencing many IR and analysis tools 2 IoCs
- UPX dump on OEP (original entry point) 4 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_e9d055ab05bce613433cd5e870b72b4a_elex_glassworm_icedid_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_e9d055ab05bce613433cd5e870b72b4a_elex_glassworm_icedid_njrat_remcos.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\s1j84oc8PE1m8N4.exeC:\Users\Admin\AppData\Local\Temp\s1j84oc8PE1m8N4.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\CTS.exeC:\Windows\CTS.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
excel.exe_Rules.xml
s1j84oc8PE1m8N4.exe
CTS.exe
memory/592-21-0x0000000000CB0000-0x00000000010F8000-memory.dmp
memory/592-26-0x0000000000CB0000-0x00000000010F8000-memory.dmp
memory/3972-2-0x0000000000E40000-0x0000000001288000-memory.dmp
memory/3972-11-0x0000000000E40000-0x0000000001288000-memory.dmp
memory/4204-12-0x0000000000CB0000-0x00000000010F8000-memory.dmp
memory/4204-36-0x0000000000CB0000-0x00000000010F8000-memory.dmp