11ab4ba70d6508e2ebac335fced471b693d5c4a13eefe9ba9be9c0aba00ac93f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260629-byardsbw2q
SHA256 11ab4ba70d6508e2ebac335fced471b693d5c4a13eefe9ba9be9c0aba00ac93f
MD5 eee4b9d0103fbfe0017a6733ab8c6dc4
SHA1 af652c53c8bcc0ac17a90ccd8de59b77773194d2
SHA512 917db4b73ea0aab9ca1f0f9ae833284fb5d2a19ecaf2d9f095b799dc022706ec106a3cdbb2f73f8065c535ff79c479e566c0c966ec052f12276202b74c232114
SSDEEP 98304:hnrgrb2ZMM6Fo7GoBFDx3q5ZuqWoTMrVrwvJpG:Fyb2KG621zoTMr
TLSH
T1AF16126BF4828073E1D14235A06D8B7AAA3C573C2364D4D717D594B79AA0CD22F34AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	6064	cmd.exe
10	6064	cmd.exe
11	6064	cmd.exe
12	6064	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z2pOHfKvW.exe	2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
5896	z2pOHfKvW.exe
3428	z2pOHfKvW.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
12	6064	cmd.exe
12	6064	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z2pOHfKvW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z2pOHfKvW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
3428	z2pOHfKvW.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe
6064	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 5568	3200	2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 5568 wrote to memory of 5896	5568	2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 5896 wrote to memory of 3428	5896	z2pOHfKvW.exe	92
PID 3428 wrote to memory of 6064	3428	z2pOHfKvW.exe	93
PID 3428 wrote to memory of 6064	3428	z2pOHfKvW.exe	93
PID 3428 wrote to memory of 6064	3428	z2pOHfKvW.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z2pOHfKvW.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z2pOHfKvW.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z2pOHfKvW.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z2pOHfKvW.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_eee4b9d0103fbfe0017a6733ab8c6dc4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z2pOHfKvW.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z2pOHfKvW.exe
Size 3.4MB
SHA256 ba03419c2855bf13711f634124cf4d08ffe6cf03247bc64bf44e54df69f6b998
MD5 499444aeb4b80d7c2b86c624b246c1bf
SHA1 482db3d781f01dd8052223b787609a63e0f60d48
SHA512 41bff4bc60d7bef00e9b22fcb49990e3aab77202a12f4db69c6b7e6c27e2e98321efcfc027f5b91062d3d7371418b8145fda175fcea487394ab201c5773ac5ff
SSDEEP 49152:SrrAtP7+UsWEKu/XPTUm7rTfcJxonrkMEaSYKi5aY/V0xBSU3+EbEB6pEXCCYJVZ:SKy7X7Nr7Rrj4liZASumoEYCu5HPeCA
TLSH
T171F523B9F8E422FFD7B55030B0CBD0258A2593DAB1653AB2B4FB94C23E63DD4920615D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-14-0x0000000000400000-0x00000000007FD6DE-memory.dmp

Download

memory/3200-0-0x0000000000400000-0x00000000007FD6DE-memory.dmp

Download

memory/3428-21-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/3428-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3428-28-0x0000000002BC0000-0x0000000002C5E000-memory.dmp

Download

memory/3428-27-0x0000000002BC0000-0x0000000002C5E000-memory.dmp

Download

memory/3428-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3428-18-0x0000000002BC0000-0x0000000002C5E000-memory.dmp

Download

memory/3428-19-0x0000000077C18000-0x0000000077C19000-memory.dmp

Download

memory/3428-23-0x0000000077C18000-0x0000000077C19000-memory.dmp

Download

memory/3428-20-0x0000000077C18000-0x0000000077C19000-memory.dmp

Download

memory/3428-24-0x0000000077C18000-0x0000000077C19000-memory.dmp

Download

memory/5568-13-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5568-1-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5568-12-0x0000000000400000-0x00000000007FD6DE-memory.dmp

Download

memory/5896-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/6064-25-0x0000000001FA0000-0x0000000002039000-memory.dmp

Download

memory/6064-31-0x00000000023C0000-0x000000000245E000-memory.dmp

Download

memory/6064-30-0x00000000023C0000-0x000000000245E000-memory.dmp

Download

memory/6064-32-0x00000000023C0000-0x000000000245E000-memory.dmp

Download

memory/6064-33-0x00000000023C0000-0x000000000245E000-memory.dmp

Download