33d75b0e1b1ca272274b9dfb500cec8dda144d1d2df3f1c3d3fdcda6f17614af

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260604-w6sbmacs8x
SHA256 33d75b0e1b1ca272274b9dfb500cec8dda144d1d2df3f1c3d3fdcda6f17614af
MD5 09bedf21200a7c8d7478227e76760fdd
SHA1 5086675efde56e69ab4e3a8be3308df164c9b7ab
SHA512 3b92b2284d5d10029692f7bc50c3858b5b1cf59a4fb51ccaac274cb394dc851cd37f49afae2ecb1c2c194c585565de51fe208f686400b3aee7fba7e32fb97d4a
SSDEEP 98304:c97nVK4Y80Uo8BsrJNEFIMPwvFiwJm7qj7tiSVrwvJpG:YVK4Y8loisrJNE1b7qjZiS
TLSH
T1D61612B3FCC1E232E1D300B69176D777CEAFD229632194D75B9148A46BB00D2EB3564A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1116	cmd.exe
4	1116	cmd.exe
5	1116	cmd.exe
6	1116	cmd.exe
7	1116	cmd.exe
8	1116	cmd.exe
9	1116	cmd.exe
10	1116	cmd.exe
20	1116	cmd.exe
21	1116	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x2FucQ50.exe	2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2464	x2FucQ50.exe
4944	x2FucQ50.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
4	1116	cmd.exe
4	1116	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2FucQ50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2FucQ50.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
4944	x2FucQ50.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe
1116	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2492	3396	2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	81
PID 2492 wrote to memory of 2464	2492	2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	83
PID 2464 wrote to memory of 4944	2464	x2FucQ50.exe	84
PID 4944 wrote to memory of 1116	4944	x2FucQ50.exe	85
PID 4944 wrote to memory of 1116	4944	x2FucQ50.exe	85
PID 4944 wrote to memory of 1116	4944	x2FucQ50.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x2FucQ50.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x2FucQ50.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x2FucQ50.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x2FucQ50.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-04_09bedf21200a7c8d7478227e76760fdd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x2FucQ50.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x2FucQ50.exe
Size 3.4MB
SHA256 3248477f9ee17e775a15659ed42a53065cdbcdabce98c9d56788ad8522506c5b
MD5 852ea9ef0bce25d55be86e03ae55ca04
SHA1 b8cb4c90c25e3f545f39bbc46b0990683747fd74
SHA512 375e4779e7e68f8752b1b4a71b1572ed1c6dd7f8c0f25f201cf9f53681cdd3d1bb3421f29a92664f818b17402f666fcac9357774386c5ff62417d3b9ff703612
SSDEEP 49152:77Y6gQ6RdBqtJlxZ5ExoK0GNM8P8fYiYD8p1/mGR9gnyq2XuQ/sAOjNYOq0w:77dBZTK0GNpwW87/mGbCx2XORYOqH
TLSH
T106F52365039CA3F0F5E3291D4E046677B0A1F7F2DBA6AB06A6676841CC7684DCC36E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-22-0x0000000000590000-0x0000000000629000-memory.dmp

Download

memory/1116-28-0x0000000000BD0000-0x0000000000C6E000-memory.dmp

Download

memory/1116-26-0x0000000000BD0000-0x0000000000C6E000-memory.dmp

Download

memory/1116-27-0x0000000000BD0000-0x0000000000C6E000-memory.dmp

Download

memory/2464-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2492-1-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2492-2-0x0000000002AE0000-0x0000000002B7E000-memory.dmp

Download

memory/2492-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2492-13-0x0000000002AE0000-0x0000000002B7E000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4944-17-0x0000000002AF0000-0x0000000002B8E000-memory.dmp

Download

memory/4944-21-0x0000000077BF4000-0x0000000077BF5000-memory.dmp

Download

memory/4944-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4944-24-0x0000000002AF0000-0x0000000002B8E000-memory.dmp

Download

memory/4944-18-0x0000000077BF4000-0x0000000077BF5000-memory.dmp

Download

memory/4944-19-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/4944-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Download