16f0a32c125ae2c865bc6ea614f6c4f293e26b12b9f9f348426dc24a96feda6f

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_f004a3af89cc92d7e983b3aad1683a81_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260522-e5alraet8k
SHA256 16f0a32c125ae2c865bc6ea614f6c4f293e26b12b9f9f348426dc24a96feda6f
MD5 f004a3af89cc92d7e983b3aad1683a81
SHA1 56a9f13f8ceca2e045b15f6b2c92976e9fb1c847
SHA512 ce160bd8278d66102d75d804257ca842ddc436deee09587902b4e1c46fceef91307bfbdb4a92f328d58bbfb0ddfd9a0512501c8e3f9a78df9143c20fd54d684a
SSDEEP 98304:p0nAAYEpphK9OU/jIEeQfoR/IuOFVjUu53:uNA9FIF0wul
TLSH
T156F59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5196	original_temp.exe
2296	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_f004a3af89cc92d7e983b3aad1683a81_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2296	original_temp.exe
2296	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5196	4920	2026-05-22_f004a3af89cc92d7e983b3aad1683a81_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	81
PID 5196 wrote to memory of 2296	5196	original_temp.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-22_f004a3af89cc92d7e983b3aad1683a81_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f004a3af89cc92d7e983b3aad1683a81_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Users\Admin\AppData\Local\Temp\jds240626390.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240626390.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 4f3da9cdbabf90f2868c2cadd69e55d506bd945269b8ddd133f1ffd5547e7122
MD5 bf2e277b3c5dec5515c3812f02386028
SHA1 8482256728c0883c65c90b43b62697b01aac0f6e
SHA512 a6ae8bf10e76cf7e4decaa15ed6ec8302f99f8c0c2a79524fa199e4e98a13887290f0a69cb621116265f2321cba700a2969ef3361296ab22a1364c1a0fee312e
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBYA+wcG83npi63iB:m6F0eMpAAYEhphhwr8XpiMw
TLSH
T150756B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.5MB
SHA256 7326e6e684c3f35d36c6107166892238e9c42bb6bf0ddc42e041fab695b787b1
MD5 8f282201fe640904c2e4d56995b48300
SHA1 790545ef81d02bf49af4cda7cac6ec4caddaa71c
SHA512 f3c592969c911bc4469acb929668e63fb8d6de165ee52b9fd29ffa0f516e80217c8fcb3851da6dfee3267147d83d930204973d53dd52bac6883b397784a23fb9
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOLYA+wc2nMYenGJiKEbXWtE:O6F0eMpAAYEhp7hw7MPnRWt4Z
TLSH
T19B759E74E783D4F1E92300F1444BE7BA69349E1944318C7BEBC8EF15BAB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240626390.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 f30c908135c39c6dbbe7ff483a4f600f74d04a0c396d6340be6348db88bd91f7
MD5 7d3508506f67355d4ba451cece2a3d7f
SHA1 bb2beeb039cdbe45d7d80d2b7f5c5a81300be571
SHA512 677726ad51495f695cfe0dc4ffd9cffa0ef7ccadc530017d56e7ae948d8872b8d83450bee9422a66257a88bde8c1d86fd9feddf895c036f95b6bd96d4cff7c83
SSDEEP 3072:+Y95aHNftUEVPUZJBtN6rxDhqbhuuEhv20O6WofUqFs0V:ga+ZZ
TLSH
T1CEF3458A853D45BB28938BD7C7B9BD649597210E839E091C62CFC2DEB441D03C66E4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 e576e6b71c93f723b87a4a979bf0384f80e530501336e9b228391dbea304e2a9
MD5 a4b69e9ad128514c4e3d4e52976bdbd2
SHA1 414a404ec0c34ae8f3d3dcc25c3df3f0e00472af
SHA512 bb3b4ae5f1ce0669464bc13e2ba12a70f3c0f14a870f3bd7efdb0d293072ab9b7e059b8ee7c2d251c28afb327a959a44bf859d4d126fc431cacc102f5c47afab
SSDEEP 3072:+Y95aHNftUEVPUZJBtN6rxDhqbhuuEhv20O6WofUqFs0H:ga+Z7
TLSH
T17AF3448A853D45BB24938BD7C7B97D649597210E83AE091C62CFC2DEB441D03CA6E4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 26c61f207b4f265d156ac61d8d000dbbd849e56c860facfad3bbd63a175ba101
MD5 be9be33f9d2b06b4d827caaeb4239545
SHA1 a0ceb939f1d62f2ce2aafe7d23af0e5e80711bfe
SHA512 63886b995ad01aa254caa85d76a8d928ba34c763e97267f012408041ed3e0cb1b2e365edab9ebbb7da444687ed28d3dd1402f93cc65ca5b0f93adda3a7975f1f
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlYA+wcu:G6F0eMpAAYEhpphwT
TLSH
T1EF456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 76b877ec716e0008486441386ccd234ac29882142e50bfef2f9bd4b1709ca1f3
MD5 5adf3297149e7383c4c07e7fea417af9
SHA1 d9bf6d3400bd2e3490c81bca7093ce9b24525dfd
SHA512 6d3ad74736783fac82d93988b10c19f7cc9e938195c156c1a61966923506c98eb559990e7e9e1a0a113ba46b51ea9a79210c2dde69c4395cee6d360537853692
SSDEEP 24576:W7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORYA+w+y:t6F0eMpAAYEhpFhwd
TLSH
T1A6456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4920-394-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads