Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 03:55
General
- Target 2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader.exe
- Size 22.4MB
- Sample260604-egsseshx2w
- SHA256 20e3444434839ad0d686f16b756b5dc82d5809e613d2121840862c5395cfa91b
Malware Config
Signatures
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1448-0-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-9-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-15-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-11-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-6-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-7-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-4-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-23-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1178-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1364-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1372-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1357-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1350-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1339-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1332-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1325-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1318-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1311-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1304-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1297-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1290-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1283-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1276-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1269-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1262-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1255-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1248-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1241-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1234-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1227-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1220-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1213-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1206-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1199-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1192-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1185-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1171-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1164-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1157-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1150-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1148-0x0000000003780000-0x00000000037C9000-memory.dmp
memory/1448-1145-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1142-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1139-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1137-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1136-0x00000000FFCB0000-0x00000000FFCB1000-memory.dmp
memory/1448-1385-0x00000000FFE30000-0x00000000FFE50000-memory.dmp
memory/1448-1398-0x00000000FFE60000-0x00000000FFE61000-memory.dmp
memory/1448-1422-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1872-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1873-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1874-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1876-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1878-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1880-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1882-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1884-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1888-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1894-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1898-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1900-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1896-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1892-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1890-0x0000000003C50000-0x0000000003CA2000-memory.dmp
memory/1448-1886-0x0000000003C50000-0x0000000003CA2000-memory.dmp