Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 22:24
Behavioral task
behavioral1
Sample
2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe
- Size 367KB
- Sample261104-2bf8rs1s2k
- SHA256 2818a2a7c140f301acd11c3cac692ea1a40ec62b820421a2cfe394b82161f706
- MD5 439a576a70d00d8470c08077010a272e
- SHA1 fe608f266237f9dfe60d788415f26576a89d308a
- SHA512 767c9cc501c40141ab6a0588d860ef0897729e5eddcb7d8f1b795ee94e46d9ea3d2c8ceffdc7e2998e504bbafb431229b4c374d96bf34353bcd2451fed792ff0
- SSDEEP 6144:wj2jaO1aK5+QPvsOvf7M7zszNdKizPcibieg0:d1rzvgWN1biu
- TLSH T18D846A4537D489A5E4FF677619B683219A32B9621B35D3CF1240C2EE0E67BC089393B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\fc.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\ftp.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\calc.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\explorer.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\cmd.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\psr.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\takeown.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\relog.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\svchost.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\runonce.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\makecab.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\whoami.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\finger.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\help.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe -
resource yara_rule behavioral2/memory/1644-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000800000001b84b-4.dat upx behavioral2/memory/1644-1096-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e000000006aaf-1113.dat upx behavioral2/memory/1644-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\7-Zip\7z.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\r\ofdeploy.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisrstas.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsv.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\hvsiproxyapp.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_e03d543c53b702b7\perfhost.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1_none_71d0d2e420e01cfd\provlaunch.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_b62f80cd4eabea24\SecEdit.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizardElev.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\upnpcont.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\appcmd.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\ScriptRunner.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\r\mcbuilder.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_2a4449c3cc3d4dce\MigRegDB.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\PATHPING.EXE- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\conhost.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.26100.1_none_694d5c871fe6dacc\CIDiag.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\r\bdechangepin.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrs.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFHost.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\r\csvde.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.26100.1150_none_eb28a122b02acd12\r\ldp.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\immersivetpmvscmgrsvr.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\quser.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\r\PackagedCWALauncher.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\eshell.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1150_none_0ba6100513fbb80d\RMActivate_ssp.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\UpgradeResultsUI.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_068e99c8dd0d8394\aspnet_wp.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\print.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\PkgMgr.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\servicing\TrustedInstaller.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\r\diskpart.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1150_none_143e6dc7df6d80b5\r\regsvr32.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\rmttpmvscmgrsvr.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\r\fsutil.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\MoUsoCoreWorker.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsvworker.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ARP.EXE- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\DeploymentAgent.exe- 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_439a576a70d00d8470c08077010a272e_conti_elex_glassworm.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.3MB
- SHA256 96b6c067825ad83d312ee1e4de79a81989306add79385b3e6c3c36b23d400f67
- MD5 ad8484cc40eb5a00da0f5736e3658d85
- SHA1 dc799734fff236dafaf45af8f86b9d0c26e6a067
- SHA512 14e2b6c08869b14973084f990d0ec7abda5190b11ffc84886ca6cafe0cb3201490219823ca18e6fd690d170d86f21c8dc035665d5ecb937bfe634f11f9a8e91e
- SSDEEP 24576:DrzIWriYa7/ezSC6vUyD/aqgrvWx6q8wyux:8W+/ezSC6vUzPvMHjyW
- TLSH T197550A15F6B88323D0B7D0BAC5E6AA99FE3230465B3085CB0246D76C2E277E5C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\EnterStep.exe-
- Size 1.3MB
- SHA256 b9605d66ce465044a2c17daad0299cef0a63814af0cc81755de761fe50a64626
- MD5 c0b53ad27a3c6de1218ce5beec9ea887
- SHA1 6909dab2cd6536e51b561647c2021cb5876a38cc
- SHA512 b9f3375064a26beaf2a1c25d41f1c60e8e8a85465354601552073298903f52028532221a63f77264a93cdc7c31a86c2b3ba63cdde8f748cca4263684f400cdb0
- SSDEEP 24576:DrzIWriaplc/rsFv4tSoaNZNql4jx58X2:8WflStlqZAlox58X2
- TLSH T10C5502423BD589A4E9FF5A762D7693209A32B9661B3193CF1140C2EE1E627C0C9357F3
- MD5 SHA1 SHA512 SSDEEP TLSH