a2f8136c369eeaffa67eab35a9ba5e663f53a8cb5045e860fd2618c2bb526e3d

Analysis

max time kernel
149s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260604-xbe89acy8n
SHA256 a2f8136c369eeaffa67eab35a9ba5e663f53a8cb5045e860fd2618c2bb526e3d
MD5 1fc524102d372b372d364ed2633d4cdc
SHA1 d3e14a6bc0f7a7a7064beb87c70c54538f467d0e
SHA512 c5ec9e15b380910be52aa21664df8b4a163f0e6e76e16bac4acaf26f96f151278fa37b2f7799e61d8b6a22f11373958a83df6797c44e201b81c4cf3387dd7b3b
SSDEEP 98304:fVrwvJpGGsRTNoov04MUp/Qm3oVr6kf6mqD8OG:fYURon4M2IF6krqDR
TLSH
T1141612156C41C07AF1D25435856AFB36BE3EE260ABE440DBD7F004B6AAA4BD26335733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4280	cmd.exe
4	4280	cmd.exe
5	4280	cmd.exe
6	4280	cmd.exe
8	4280	cmd.exe
9	4280	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZquJhpf.exe	2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
1108	ZquJhpf.exe
1724	ZquJhpf.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
3	4280	cmd.exe
3	4280	cmd.exe
9	4280	cmd.exe
9	4280	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZquJhpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZquJhpf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
1724	ZquJhpf.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe
4280	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1560	1720	2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	81
PID 1560 wrote to memory of 1108	1560	2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	83
PID 1108 wrote to memory of 1724	1108	ZquJhpf.exe	84
PID 1724 wrote to memory of 4280	1724	ZquJhpf.exe	85
PID 1724 wrote to memory of 4280	1724	ZquJhpf.exe	85
PID 1724 wrote to memory of 4280	1724	ZquJhpf.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZquJhpf.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZquJhpf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZquJhpf.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZquJhpf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fc524102d372b372d364ed2633d4cdc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZquJhpf.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZquJhpf.exe
Size 3.4MB
SHA256 dc9b0251aaa8a46bc1665349679cf598db75040ee606342d528cc199b76ae0a7
MD5 0365a730a001b10153b70bb8d9fe4354
SHA1 b815f6a596af7f062d7200efba61da5e03c25fc2
SHA512 b05b8eb2426451bd4dd608e799e79d1e6aec55afea999f06df2f5b3bc88259547e1c670b932ae600504000a4828a36c327182aff08e5158df960c58f001db7b2
SSDEEP 49152:73WLp8ZvuOX3LE/VqfWatfFXVGado6/d0sq75rsVZkanb1OQWNwiHws9HTQ:CLpoBNUqYsgab1Os5SQ
TLSH
T16EF522D76573567BC262AFB946A20BD6CBB3D939C2C09166C4076FBE0BC034C8972725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-19-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1108-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1560-2-0x0000000000B80000-0x0000000000C1E000-memory.dmp

Download

memory/1560-1-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/1560-13-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/1560-14-0x0000000000B80000-0x0000000000C1E000-memory.dmp

Download

memory/1720-0-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/1720-10-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/1724-22-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/1724-18-0x0000000077214000-0x0000000077215000-memory.dmp

Download

memory/1724-17-0x0000000000B90000-0x0000000000C2E000-memory.dmp

Download

memory/1724-20-0x0000000077214000-0x0000000077215000-memory.dmp

Download

memory/1724-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1724-23-0x0000000077214000-0x0000000077215000-memory.dmp

Download

memory/1724-26-0x0000000000B90000-0x0000000000C2E000-memory.dmp

Download

memory/4280-24-0x0000000001A40000-0x0000000001AD9000-memory.dmp

Download

memory/4280-28-0x0000000001ED0000-0x0000000001F6E000-memory.dmp

Download

memory/4280-29-0x0000000001ED0000-0x0000000001F6E000-memory.dmp

Download

memory/4280-30-0x0000000001ED0000-0x0000000001F6E000-memory.dmp

Download

memory/4280-31-0x0000000001ED0000-0x0000000001F6E000-memory.dmp

Download