Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
10/12/2025, 03:52
General
- Target 2025-12-10_c81eda7eed60c8d2a29644b55047b624_amadey_cobalt-strike_glassworm_luca-stealer_njrat.exe
- Size 12.2MB
- Sample251210-efh7latldt
- SHA256 c854958ee0eb519f8e56355603de058b5af7b0b0701c6ae1c3199d867fed09e8
Malware Config
Extracted
-
stealc
-
jopa
-
http://194.33.61.95
-
url_path
/a927e02a8d5e42df.php
Signatures
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-12-10_c81eda7eed60c8d2a29644b55047b624_amadey_cobalt-strike_glassworm_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2025-12-10_c81eda7eed60c8d2a29644b55047b624_amadey_cobalt-strike_glassworm_luca-stealer_njrat.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\k6YFwG15mlto.exe"C:\Users\Admin\AppData\Local\k6YFwG15mlto.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
B3D966F9-8262-8AE5-8671-8A9D6E6932D5.txt
B3D966F9-8262-8AE5-8671-8A9D6E6932D5.txt
3llk2zUK4E2D.exe
k6YFwG15mlto.exe
memory/1484-5-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-4-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-1-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-13-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-12-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-11-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-10-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-9-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-8-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-7-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-6-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-3-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-2-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-16-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-19-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/1484-1075-0x0000000140000000-0x00000001400CC000-memory.dmp
memory/4512-80-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-154-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-71-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-104-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-86-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-82-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-72-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-108-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-106-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-102-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-100-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-98-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-96-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-94-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-92-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-90-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-89-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-84-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-69-0x0000000000550000-0x0000000000606000-memory.dmp
memory/4512-78-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-76-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-74-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-114-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-168-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-164-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-162-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-160-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-158-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-156-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-70-0x0000000004CA0000-0x0000000004D6A000-memory.dmp
memory/4512-152-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-150-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-148-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-144-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-142-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-140-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-138-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-137-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-134-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-130-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-128-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-126-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-124-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-122-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-120-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-118-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-116-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-112-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-166-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-146-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-132-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-110-0x0000000004CA0000-0x0000000004D63000-memory.dmp
memory/4512-997-0x0000000004E10000-0x0000000004E64000-memory.dmp
memory/4512-998-0x0000000004E60000-0x0000000004EAC000-memory.dmp
memory/4512-999-0x0000000005820000-0x0000000005DC6000-memory.dmp
memory/4512-1000-0x0000000005270000-0x0000000005302000-memory.dmp
memory/4512-1001-0x0000000005120000-0x000000000512A000-memory.dmp