22bee3a79971690d5ca4d3e0621f4742aa83dea14a35d5af18a41980b70d4f98

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260629-ddb5tsbx4x
SHA256 22bee3a79971690d5ca4d3e0621f4742aa83dea14a35d5af18a41980b70d4f98
MD5 cae9b6cd7262260f28c3f08d45eb28d4
SHA1 08722aff9475046af740d3a46c5d792d297a850c
SHA512 bcefa3a14d2286061e14f179ef642332419857a1cf15311edf9b299764ddaeca7b7ecbc7184f27fea6c6d37b75f0577ddd61c297c8eb00899c879e9c31e0614b
SSDEEP 98304:8VrwvJpG2+KIMlLwYGGRHTZF2zp+fBFzcXotlB5N23kMPMnbE65:8UVlLwqzD2VWBFMUL5NQkMPMn5
TLSH
T1E8161291B941C032E89B013C936FBF354E3DB2215727B5C736E074EA5B204DA667AE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	6980	cmd.exe
9	6980	cmd.exe
10	6980	cmd.exe
11	6980	cmd.exe
12	6980	cmd.exe
15	6980	cmd.exe
16	6980	cmd.exe
17	6980	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBD0PTtRV.exe	2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
4812	rBD0PTtRV.exe
7080	rBD0PTtRV.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
9	6980	cmd.exe
9	6980	cmd.exe
17	6980	cmd.exe
17	6980	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rBD0PTtRV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rBD0PTtRV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
7080	rBD0PTtRV.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe
6980	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2864	4940	2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 2864 wrote to memory of 4812	2864	2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	92
PID 4812 wrote to memory of 7080	4812	rBD0PTtRV.exe	93
PID 7080 wrote to memory of 6980	7080	rBD0PTtRV.exe	94
PID 7080 wrote to memory of 6980	7080	rBD0PTtRV.exe	94
PID 7080 wrote to memory of 6980	7080	rBD0PTtRV.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBD0PTtRV.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBD0PTtRV.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBD0PTtRV.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBD0PTtRV.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_cae9b6cd7262260f28c3f08d45eb28d4_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:7080
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rBD0PTtRV.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBD0PTtRV.exe
Size 3.4MB
SHA256 4a94f54edff71455cff77ddbe23f58604a8add3edc7c2314b5dcf0893d9da5b4
MD5 f1acae1de29a9793ccf4a9d26366604f
SHA1 a3eafdab98cb8fac236580bec1f04e6afa14fccf
SHA512 ff259b5a37df78b62879edbd34a5697bb62e324ae51ff9c37eac4c840310e6fc06f34a6c1fdf7c2d221d937fe67f76d7a6b976264832d07c68a8e82fd807ed9b
SSDEEP 98304:dQZZS/2wz2kqntG4awysYmlET6OwV0Stw:uZZrwzsEvVsYmlIYw
TLSH
T1E4F5228168D1C836DFE1BDB4E38F1A0235681E94EFB94DBB0244C981EB5141677CADAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-1-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/2864-2-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/2864-11-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/2864-12-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4812-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4812-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4940-3-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/4940-0-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/6980-34-0x00000000026B0000-0x000000000274E000-memory.dmp

Download

memory/6980-33-0x00000000023D0000-0x0000000002469000-memory.dmp

Download

memory/6980-26-0x00000000023D0000-0x0000000002469000-memory.dmp

Download

memory/6980-32-0x00000000026B0000-0x000000000274E000-memory.dmp

Download

memory/6980-31-0x00000000026B0000-0x000000000274E000-memory.dmp

Download

memory/6980-30-0x00000000026B0000-0x000000000274E000-memory.dmp

Download

memory/7080-20-0x0000000077B68000-0x0000000077B69000-memory.dmp

Download

memory/7080-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/7080-28-0x0000000000BC0000-0x0000000000C5E000-memory.dmp

Download

memory/7080-25-0x0000000077B68000-0x0000000077B69000-memory.dmp

Download

memory/7080-22-0x0000000077B68000-0x0000000077B69000-memory.dmp

Download

memory/7080-23-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/7080-19-0x0000000000BC0000-0x0000000000C5E000-memory.dmp

Download

memory/7080-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download