160c5c703f70fbc348fe0f8410eea2dfb8e1e0d819313171f32c4c2c50ad7655

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260419-tf2q9set7m
SHA256 160c5c703f70fbc348fe0f8410eea2dfb8e1e0d819313171f32c4c2c50ad7655
MD5 b4a6367638e8857a999489b1d260d291
SHA1 dfce649a3930d8b77176f3df879acdc06f89cebd
SHA512 efc8be32e21f05ecafb7e708e77796c4e8be78fd0fa8ce757a6e664269d563c41683c2b8cb78a269e5d2d4be1277422f68fe2b6ccc1a42e34ec1e5f96c5857d7
SSDEEP 49152:j9hd/PMTKz+37NKMegXFbr81j1IZ9X0OXFz9wvJpGVb:j9hd/PMWz+LNKdWr81j1IrXVrwvJpG
TLSH
T1D916D023AF4EF023F6920036D1649A322EEFD620AF0771D7669B04775AE0CD19EF5646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	RXGiQdEHf.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXGiQdEHf.exe	2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
3468	RXGiQdEHf.exe
3736	RXGiQdEHf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4032	5056	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RXGiQdEHf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RXGiQdEHf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
3736	RXGiQdEHf.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe
5056	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4784	4616	2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	85
PID 4784 wrote to memory of 3468	4784	2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	87
PID 3468 wrote to memory of 3736	3468	RXGiQdEHf.exe	88
PID 3736 wrote to memory of 5056	3736	RXGiQdEHf.exe	89
PID 3736 wrote to memory of 5056	3736	RXGiQdEHf.exe	89
PID 3736 wrote to memory of 5056	3736	RXGiQdEHf.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXGiQdEHf.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXGiQdEHf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXGiQdEHf.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXGiQdEHf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-19_b4a6367638e8857a999489b1d260d291_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 668
        6⤵
        Program crash
        
        PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5056 -ip 5056
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RXGiQdEHf.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXGiQdEHf.exe
Size 3.4MB
SHA256 c665736cc78a940140f48cc4341281d488047c7047a2c7511e9f8dbdf87c0d78
MD5 05837a400c6b540ee119f24a6090c5f6
SHA1 184c55412748b49cc057297219a835ac34718e88
SHA512 7bef88fec7c431abb09211afb47f20ee0402ee6b850aa9cbca53b387e0fce8d6f27d77716436f778e7f65eda8ffa9afac93e37d47143538920fe6878ba3266c7
SSDEEP 24576:+lmqh3rhZeWs3B2ScjEtcP1prgC+nRUk3yGcby7fZoMn36DIKq7XAKHm4:+lmgMwScjhP1UR/Cr27fWCLAKH
TLSH
T1E4F5DFE6426CCA3BAC417E22F3F7D20CA416322A45E9948E3E617D8B4B757D5D23D087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3468-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3468-10-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3736-22-0x00000000778E2000-0x00000000778E3000-memory.dmp

Download

memory/3736-19-0x0000000002990000-0x0000000002991000-memory.dmp

Download

memory/3736-27-0x00000000029C0000-0x0000000002A5E000-memory.dmp

Download

memory/3736-18-0x00000000778E2000-0x00000000778E3000-memory.dmp

Download

memory/3736-16-0x00000000029C0000-0x0000000002A5E000-memory.dmp

Download

memory/3736-24-0x00000000778E2000-0x00000000778E3000-memory.dmp

Download

memory/3736-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3736-23-0x00000000778E2000-0x00000000778E3000-memory.dmp

Download

memory/3736-21-0x00000000778E2000-0x00000000778E3000-memory.dmp

Download

memory/4616-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4784-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4784-1-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4784-2-0x0000000000A50000-0x0000000000AEE000-memory.dmp

Download

memory/4784-13-0x0000000000A50000-0x0000000000AEE000-memory.dmp

Download

memory/5056-25-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Download