efb5d31181e4abe1d3d69489f666685062eb17d9bc094e86cc85274351de0f1a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260629-2d5ddagx4s
SHA256 efb5d31181e4abe1d3d69489f666685062eb17d9bc094e86cc85274351de0f1a
MD5 50acc00b20b05b40358b3638e26f9106
SHA1 70702b63deb5437655dc6fbf6f967018982ea21d
SHA512 901476d7b3d4655e19d767480b3e0cfecf6e304b14c0a9ca82aeb9cae601b0a358fd05d9de276ef84fa21ed99e5ee86fd6a3e074a69d62a5671441763beb81b0
SSDEEP 49152:g0OXFz9wvJpGVbfbyJ73JO2Nt+bEn0VLyON6Fk1SE0yz8J6g7v:gVrwvJpG0J7JpNt+40VLyy1/z8Jf
TLSH
T1C7169D2378C190E3E1F7003A93A56E75BA2B6A1687979CC752A1E4619F5C0CF32E7D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1kMujpAQS9p.exe	2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
5208	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3992	6916	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1kMujpAQS9p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1kMujpAQS9p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
5552	1kMujpAQS9p.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe
6916	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 3700	5740	2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	88
PID 3700 wrote to memory of 5208	3700	2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 5208 wrote to memory of 5552	5208	1kMujpAQS9p.exe	91
PID 5552 wrote to memory of 6916	5552	1kMujpAQS9p.exe	92
PID 5552 wrote to memory of 6916	5552	1kMujpAQS9p.exe	92
PID 5552 wrote to memory of 6916	5552	1kMujpAQS9p.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Users\Admin\AppData\Local\Temp\2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1kMujpAQS9p.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1kMujpAQS9p.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1kMujpAQS9p.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1kMujpAQS9p.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-25_50acc00b20b05b40358b3638e26f9106_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 648
        6⤵
        Program crash
        
        PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6916 -ip 6916
1⤵
PID:7004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1kMujpAQS9p.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1kMujpAQS9p.exe
Size 3.4MB
SHA256 65dc14522a2c167b23e450805615944a4ac463ce5fa07506c6b2a6470ff6decc
MD5 0c1f1b41005f06f45c5115ed584e0c55
SHA1 dda28fb39cd5a3a37641c45db334c73a131d7599
SHA512 56c418714711fb0a4a32b1d1d7edcc34f86f1d7c352aee54d5174ddd1b757666463ca0c00ab0f1b86596afb68dc124876617ecb120c44d88095e306ad02af0ee
SSDEEP 24576:fo2zKd++vXbuxFsCT8Gk4cff4uSQcqN7fkdsvhs2Ui3WjYOvGFpEWXa:wcKd+wLufsCzuXIKK9YhXa
TLSH
T1E0F5BC5478FB17D29DB167EB8E43F02F2F34F226B16C146728286849738AC74AD8945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3700-14-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/3700-1-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/3700-12-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/5208-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5552-20-0x0000000077A38000-0x0000000077A39000-memory.dmp

Download

memory/5552-29-0x0000000002880000-0x000000000291E000-memory.dmp

Download

memory/5552-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5552-18-0x0000000002880000-0x000000000291E000-memory.dmp

Download

memory/5552-19-0x0000000077A38000-0x0000000077A39000-memory.dmp

Download

memory/5552-31-0x0000000002880000-0x000000000291E000-memory.dmp

Download

memory/5552-21-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/5552-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5552-23-0x0000000077A38000-0x0000000077A39000-memory.dmp

Download

memory/5552-24-0x0000000077A38000-0x0000000077A39000-memory.dmp

Download

memory/5552-25-0x0000000077A38000-0x0000000077A39000-memory.dmp

Download

memory/5552-26-0x0000000077A38000-0x0000000077A39000-memory.dmp

Download

memory/5740-2-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/5740-0-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/6916-27-0x0000000000950000-0x00000000009E9000-memory.dmp

Download

memory/6916-30-0x0000000000CB0000-0x0000000000D4E000-memory.dmp

Download

memory/6916-33-0x0000000000CB0000-0x0000000000D4E000-memory.dmp

Download