Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
27/05/2026, 16:20
General
- Target 2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
- Size 6.7MB
- Sample260527-ts8ekses5y
- SHA256 4fe8d0c482600fae65af5e362ed180b811503c7693731123af4cd19a1007b913
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 3 IoCs
- Looks for Xen service registry key. 1 TTPs 5 IoCs
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\59FD49208E951F11D80F6F4DEFB41EC3\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Windows\temp\59FD49208E951F11D80F6F4DEFB41EC3\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077A7D208E951F11D80F6F4DEFB41EC3\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\077A7D208E951F11D80F6F4DEFB41EC3\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADgIxMIAQSCquE4VG3cOXWTAuAAAHQR//8vb9r7YNQj4y8AGQAHAEQAYgBpAGwAZAB6AG0AagAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQAzADEAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Kaspersky Lab Setup Files\SAAS21.25.7.504.0.280.0\au_setup_139FF07E-59E8-11F1-8DF0-F6D4FE4BE13C\startup.exe"C:\ProgramData\Kaspersky Lab Setup Files\SAAS21.25.7.504.0.280.0\au_setup_139FF07E-59E8-11F1-8DF0-F6D4FE4BE13C\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" /-self_remove -l=es-MX -prevsetupver=21.25.7.504.0.73.0 -xpos=578 -ypos=2223⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\2896C3D18E951F11D80F6F4DEFB41EC3\startup.exe"C:\Windows\temp\2896C3D18E951F11D80F6F4DEFB41EC3\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" /-self_remove -l=es-MX -prevsetupver=21.25.7.504.0.73.0 -xpos=578 -ypos=2224⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\021015E18E951F11D80F6F4DEFB41EC3\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\021015E18E951F11D80F6F4DEFB41EC3\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAAipFoTQrWJxbiDfZFRVOzYAqgAAJQT//9+h+8YBXoU2C8AGQAHAEQAYgBpAGwAZAB6AG0AagAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQAzADEAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\temp\59FD49208E951F11D80F6F4DEFB41EC3\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Windows\temp\59FD49208E951F11D80F6F4DEFB41EC3\2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\077A7D208E951F11D80F6F4DEFB41EC3;4468"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
4Replay Monitor
Loading Replay Monitor...
Downloads
dynamic.ini
startup.exe
static.ini
kdscrl.rdb.z
kdscrl.rdb
setup.dll
setup_ui.exe
GuiStrings.loc
GuiStrings_SAAS.loc
GuiStrings_es-MX_SAAS.loc
downloader_neutral.ini
downloader_neutral_SAAS.ini
ksde_eula_es-mx.txt
ksde_ksn_es-mx.txt
ksde_pangovpnstatement_es-mx.txt
ksde_purevpnstatement_es-mx.txt
ksde_sdwanglobalvpnstatement_es-mx.txt
ksde_sdwanruvpnstatement_es-mx.txt
mykasperskyfeatures_es-mx.txt
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
GuiStrings_es-MX.loc
downloader_es-MX.ini
discovery.cfg
2026-05-27_923147696f24f1a26f9dc5a49dcd6554_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
memory/1868-1-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/1868-0-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/1868-2-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/2872-189-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/2872-191-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/2872-190-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/3416-405-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/3416-406-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/3416-407-0x0000000077AB0000-0x0000000077AC0000-memory.dmp
memory/4468-7-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
memory/4468-8-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
memory/4468-6-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
memory/4496-96-0x0000000006400000-0x00000000067A8000-memory.dmp
memory/4496-124-0x00000000077D0000-0x00000000077EC000-memory.dmp
memory/4496-145-0x00000000002F0000-0x00000000003A5000-memory.dmp
memory/4496-40-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4496-43-0x0000000005470000-0x000000000547E000-memory.dmp
memory/4496-46-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4496-144-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4496-143-0x000000000BA80000-0x000000000BA8E000-memory.dmp
memory/4496-142-0x000000000B930000-0x000000000B938000-memory.dmp
memory/4496-141-0x000000000B9F0000-0x000000000BA50000-memory.dmp
memory/4496-137-0x000000000B950000-0x000000000B9E2000-memory.dmp
memory/4496-51-0x0000000005970000-0x00000000059C0000-memory.dmp
memory/4496-116-0x0000000007730000-0x0000000007746000-memory.dmp
memory/4496-120-0x0000000007750000-0x0000000007760000-memory.dmp
memory/4496-309-0x00000000002F0000-0x00000000003A5000-memory.dmp
memory/4496-146-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4496-132-0x0000000007930000-0x00000000079E4000-memory.dmp
memory/4496-136-0x00000000077F0000-0x0000000007810000-memory.dmp
memory/4496-128-0x0000000007830000-0x0000000007864000-memory.dmp
memory/4496-112-0x0000000007760000-0x00000000077A8000-memory.dmp
memory/4496-107-0x0000000006BB0000-0x0000000006C64000-memory.dmp
memory/4496-103-0x0000000006AC0000-0x0000000006AE6000-memory.dmp
memory/4496-99-0x00000000068E0000-0x0000000006918000-memory.dmp
memory/4496-98-0x0000000006D60000-0x0000000007306000-memory.dmp
memory/4496-97-0x00000000060C0000-0x0000000006126000-memory.dmp
memory/4496-92-0x0000000005B80000-0x0000000005B96000-memory.dmp
memory/4496-88-0x0000000005BA0000-0x0000000005C08000-memory.dmp
memory/4544-272-0x0000000000EA0000-0x0000000000F55000-memory.dmp
memory/5012-200-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
memory/5012-201-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
memory/5012-202-0x0000000077AC0000-0x0000000077AD0000-memory.dmp