8ebf29d70c5b60edda7e8bef4878b1d7f3a83edb5a6c3ca2930ebc94d0bb8b68

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Size 354KB
Sample260701-2c6j2sg15s
SHA256 8ebf29d70c5b60edda7e8bef4878b1d7f3a83edb5a6c3ca2930ebc94d0bb8b68
MD5 1d105519426df07eed61464921fa91b2
SHA1 8dc6dd252d8ea20f3e7cebf06a4c703bb55b6a20
SHA512 df3c7d6e70883afa23c7c32451375aee145f8e3af2705f0cf70b3e86dc96524d607d7b4ed120bc58bec8b0f623e4dc19477dae0f33341a42259b026415dba8d8
SSDEEP 6144:XQ8/2VvPOaz5LIzLtZt1PxzrTwAOoTB5Y2Ja9x3HL7zx:T/Chz5czLna6THY2JOxb7zx
TLSH
T1CA749D1171C188F2C47201714CEBB739592FB92F0F218DEB6F9A27295DA42D16A316EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\smss.exe"	2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\smss.exe"	2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\smss.exe"	smss.exe

Detects executables packed with ASPack 6 IoCs

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c601-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4508-11-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5980-13-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5980-23-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5980-24-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c601-6.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5980	smss.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\smss.exe	2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4508	2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
5980	smss.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 5980	4508	2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_1d105519426df07eed61464921fa91b2_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\smss.exe
  C:\Windows\smss.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\Windows\smss.exe
Size 26KB
SHA256 03306089c280e965910d4b4d7650662691e698003b83118e4ec8da3b58450370
MD5 fe9234562c8f3bdf76a35b75553a76ae
SHA1 4ae6adaa27d4bcfd1d7906dfd8c29cc1d460313a
SHA512 331d7e5f2f2bf5f8c3173031956a7c60d668d2d11b54cc47b64257b74141d49e968fed100bbc3ab9d7415706ad8cb6ba158580a1a6321e3eb03f6e91c76dd775
SSDEEP 384:M1NgSXx3TZEBhsaOczqESacYhz6WWBHfXo5NUXxNjYqDvvUJHAxgr6+S9Pfu7n5o:M1g/pLzqAkRXoqIyxHdeVo
TLSH
T174C2BF62FBB9CC6BC294143298329B9D7B60AD214D1103C733E27B1FEC38419CE565AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4508-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4508-11-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5980-13-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5980-23-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5980-24-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads