f549465fd03cefddfdcebeb6096561f27ac07b71043aaa262be44b6e69f69a97

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260701-cnb25set61
SHA256 f549465fd03cefddfdcebeb6096561f27ac07b71043aaa262be44b6e69f69a97
MD5 ecc29a1c0b7a933b584b52befe3bc8bf
SHA1 6627f97cda26b2d9a525f12ffc709bb6424448e4
SHA512 908aa289166915c7f3b9f3b52ce00e7d11c688385561cc8a0482e5c42599b035f8b2221970fe41bb752e0abd7b212cb7954eedbfbbb0dc1a219ee046d1e70cf9
SSDEEP 98304:cVrwvJpG+U6rvxxdcWy+S2+fvkFUd98f8EcldnkVRv:cmxXy+S5fvo/8EckVRv
TLSH
T11D1612117D4280B2F2E61037B9BACB7ADE2CB6306324A0E76BD415F55A634E1FB34746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1592	cmd.exe
4	1592	cmd.exe
5	1592	cmd.exe
9	1592	cmd.exe
10	1592	cmd.exe
11	1592	cmd.exe
12	1592	cmd.exe
14	1592	cmd.exe
15	1592	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBzLDTKloc.exe	2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2932	BBzLDTKloc.exe
1040	BBzLDTKloc.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
15	1592	cmd.exe
15	1592	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBzLDTKloc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBzLDTKloc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1040	BBzLDTKloc.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe
1592	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 3092	5764	2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	88
PID 3092 wrote to memory of 2932	3092	2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 2932 wrote to memory of 1040	2932	BBzLDTKloc.exe	91
PID 1040 wrote to memory of 1592	1040	BBzLDTKloc.exe	92
PID 1040 wrote to memory of 1592	1040	BBzLDTKloc.exe	92
PID 1040 wrote to memory of 1592	1040	BBzLDTKloc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Local\Temp\2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBzLDTKloc.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBzLDTKloc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBzLDTKloc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBzLDTKloc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_ecc29a1c0b7a933b584b52befe3bc8bf_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BBzLDTKloc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBzLDTKloc.exe
Size 3.4MB
SHA256 6bf408d3a38b42c908bbc925996554468cf385270c622183b302a24cb76f3c9e
MD5 a2554298c350a8963b415d5fd7853955
SHA1 d01c501b9c51ea57578e1695a77400961c3fbb38
SHA512 0a5b0a5a684b6d6bf7892abc261dd3c2fda0233cb367ba02d74da99e5a51e892a5f2e22cfa71b59677fbb010b66b7315961480012f5507e85267931df75fec56
SSDEEP 98304:fPMVzzZMIxnfV04kp1HzHn76UwCGCYhj:fPW3SIxfV04kp1TH76UwCGFj
TLSH
T111F523D377949552F080FC7185E99BE0F8FFB82C997DEE067456E84428A2D93E6302C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-17-0x0000000000BC0000-0x0000000000C5E000-memory.dmp

Download

memory/1040-25-0x0000000000BC0000-0x0000000000C5E000-memory.dmp

Download

memory/1040-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1040-22-0x00000000774E8000-0x00000000774E9000-memory.dmp

Download

memory/1040-19-0x00000000774E8000-0x00000000774E9000-memory.dmp

Download

memory/1040-20-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/1592-27-0x00000000024B0000-0x000000000254E000-memory.dmp

Download

memory/1592-23-0x0000000001FF0000-0x0000000002089000-memory.dmp

Download

memory/1592-28-0x00000000024B0000-0x000000000254E000-memory.dmp

Download

memory/1592-29-0x00000000024B0000-0x000000000254E000-memory.dmp

Download

memory/1592-30-0x0000000001FF0000-0x0000000002089000-memory.dmp

Download

memory/1592-31-0x00000000024B0000-0x000000000254E000-memory.dmp

Download

memory/2932-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2932-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3092-14-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/3092-13-0x0000000000400000-0x00000000007FD8FF-memory.dmp

Download

memory/3092-1-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5764-10-0x0000000000400000-0x00000000007FD8FF-memory.dmp

Download

memory/5764-0-0x0000000000400000-0x00000000007FD8FF-memory.dmp

Download