6fb93fb9e3fdaae1ead89f6383045ad92d90072ca1e04468ac4503ef8ec27b9e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_f59f7c5f6eb98d1d4a33fac5e55e185e_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 3.9MB
Sample260604-tmr6eabs8l
SHA256 6fb93fb9e3fdaae1ead89f6383045ad92d90072ca1e04468ac4503ef8ec27b9e
MD5 f59f7c5f6eb98d1d4a33fac5e55e185e
SHA1 5855b9e0ba47e6c07985e3c93350fb19b9a82d5f
SHA512 cc44efaff34fc2487be2bac0cf610acbc3db7ae9ca80f9411391d086623038b3166ddb595b38385d1105387a73a92d5ee9f99b810b5fd4dd7222de61521302ce
SSDEEP 49152:toa1taC070UaygsKjicBE2n6Nz57bVmgbQIzZMPXpB91rHpn:toa1taC0gygsKGDqnLrHp
TLSH
T13816CF57EB918AE8E68D09366B584150DB2EF621AB4F2351396C420DCF873878F61F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1572	2DC2.tmp

Executes dropped EXE 1 IoCs

pid	Process
1572	2DC2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_f59f7c5f6eb98d1d4a33fac5e55e185e_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2DC2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1572	756	2026-06-04_f59f7c5f6eb98d1d4a33fac5e55e185e_amadey_elex_glassworm_njrat_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-04_f59f7c5f6eb98d1d4a33fac5e55e185e_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f59f7c5f6eb98d1d4a33fac5e55e185e_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\2DC2.tmp
  "C:\Users\Admin\AppData\Local\Temp\2DC2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-04_f59f7c5f6eb98d1d4a33fac5e55e185e_amadey_elex_glassworm_njrat_smoke-loader.exe B9A6D57991E2C9CAA13305D5610ECD0002B1215A6DB664D795185A565471186C91AE52A7FB1104FB8941E478DD233DB73B36611C00D59F66AE0B6E3655913317
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2DC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\2DC2.tmp
Size 3.9MB
SHA256 66dab49a569a7c897fcc43fdb13b3d72a74a0d2a2495afd074cffffdfd363d3f
MD5 04f3ce71b7d00219cb93d3a4374ebeb7
SHA1 819e508015388592dd0628f15fcb0a0c32f8e248
SHA512 d1dbe13ea5ec47df34bee84accbc30a9ed082f7f47f0b924b90a54f4e4fabd972503ca46b2d9e79e76fa13b32cfaa837c36c62c2c043d998b0e6491a4c308c2c
SSDEEP 49152:toa1taC070UFNap+kk9xvIp7J5IY1Cwsu4VmgbQIzZMPXpB91rHpn:toa1taC0XNi+DY8MCAnLrHp
TLSH
T17816CE53EB918AE8F68D09366B544150DB2EF621AB4F2351396C420DCF8738B8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download