Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
- Size 3.6MB
- Sample260604-pchf1ae12l
- SHA256 95b8faf6981ba329abba5382be2f35aae5e10e274ff6745b02e3f006e1209ec1
- MD5 e2a88c013bad209916ec4bdad5be4034
- SHA1 da0eabd5e04bb9106076ba1b208548f10c3123bd
- SHA512 293ee840261696da69666b56ba0def0a229c947c9b0d7e8bd390f72d8e6d790e89145941b305cb553d80a1553ae32062ad0ed29ce2d767309db54b22d2767d5a
- SSDEEP 49152:0VZn92IgpYq4T3S9tsgX8zEC8ULgCSA/Bkj0R:CZnTg6JTIOSAD
- TLSH T14D067B1373E44537E1BE663E80B1193D97B5B93B9B36C74F7504B89E49A27828A13323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000600000000d414-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000600000000d414-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dccw.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\netsh.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\where.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\chcp.com- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\sort.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\subst.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\control.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\runas.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\psr.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\findstr.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\logagent.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\systray.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\clip.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\doskey.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Windows Mail\wab.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.22000.1_none_6180ec8e85a3740e\imjpuexc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\r\IESettingSync.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_e4c8388cb4892f1c\BackgroundTransferHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.22000.1_none_a061a9a7af162f02\spaceman.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\r\TpmTool.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrshost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\f\SecurityHealthSystray.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.1_none_ac71a9e770c9ec63\tar.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.22000.1_none_28ee3eaabde6507f\hh.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_7181babcedfc2cb7\aspnetca.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\f\hvix64.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.22000.41_none_87f7650fac06c0f2\r\CredentialEnrollmentManager.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.22000.1_none_11dd22030027b61b\sigverif.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\r\SearchFilterHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.22000.1_none_1b04230fd5e53bb5\verifiergui.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_71a457162e76ab00\RunLegacyCPLElevated.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\AppVStreamingUX.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\LicensingUI.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\rdpclip.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.22000.318_none_92049afacb4417d8\f\dtdump.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.22000.1_none_4c569ced0ca81910\user.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.22000.1_none_9d236d8db8081199\rstrui.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.22000.1_none_b7c933829422be28\netiougc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\MiniSearchHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-add.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.22000.318_none_92049afacb4417d8\f\dtdump.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.22000.1_none_98005a471b61ee29\EhStorAuthn.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\SystemSettings.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.22000.1_none_8de8e95b9cda88b4\MigRegDB.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\ROUTE.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.22000.1_none_e2a80a66cb0dc4bd\timeout.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchIndexer.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.22000.1_none_b90ac474910a4673\expand.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.22000.1_none_7a0735d8628d0c40\dxdiag.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.22000.1_none_73c734e8920ab338\LegacyNetUXHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_b2ca9978aba0e546\net.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.22000.1_none_3adc01d6a79fa581\EoAExperiences.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\r\LockApp.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpconfig.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\immersivetpmvscmgrsvr.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.22000.1_none_22c39620f56d14c6\wiawow64.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.22000.1_none_2d8b0e006fd7fa09\VMCreate.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15806.0_none_8ce2f3fe679c53cd\RegSvcs.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchProtocolHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.22000.1_none_90cfdfd0a3fa1534\IMEPADSV.EXE- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.469_none_bc884b259290e3bf\DeviceEnroller.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\f\wlrmdr.exe- 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.2MB
- SHA256 2339db81b90024d29e1caad8e371678b3b85e9e55b0777ec5e4c5f7ca0bfd154
- MD5 8574f15898de6b6938c8bed031c53efb
- SHA1 503d57109e489eabf744c9001e96b0d9d4b91e2a
- SHA512 add07fca317b2a42311e50b95665705d92dd36e0b25161fba1ceccb95d45eb7056bb5bef76f3a57b317c6774355b8828369a513c2c563a26a9cfe7598c9a97ef
- SSDEEP 49152:0VZn92IgpYq4T3S9tsgX8zEC8ULgCSA/Bkj01Pji0AjD:CZnTg6JTIOSA7jon
- TLSH T1BE167C12B3E44637E07A923EC0B1197DA775793B9B32C78F3504B96E5DA27828527323
- MD5 SHA1 SHA512 SSDEEP TLSH