576b87b927a95ae078c0c956e82240d5137079b9a78bbfbb54ab9866577ea0f0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260701-xqldtaex21
SHA256 576b87b927a95ae078c0c956e82240d5137079b9a78bbfbb54ab9866577ea0f0
MD5 7e28e0149294112ccfcb5fe120eecb3f
SHA1 58e8685d32a05972e6b8db7cb17a245244c70bae
SHA512 b14c8572782efe1cbfeb189db1995760cba2dea0dc26ef2541e3eb891f3f11a88f474aa10cfeb53057a5e4a2dd93a35d3048b93290ac4a6df131b1b50960d013
SSDEEP 98304:AVrwvJpGz77xZJ4cIHyxe5lQsNy1eon5J:AR77KKk5ysy1eo
TLSH
T1BD16BD11E4804062E3433075D7AA86AEAEABD66533DCF1CF5ECC40AA66D0FD15727F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kUIxmmi.exe	2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
5752	kUIxmmi.exe
1332	kUIxmmi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	2908	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kUIxmmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kUIxmmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
1332	kUIxmmi.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe
2908	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 5588	5328	2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 5588 wrote to memory of 5752	5588	2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 5752 wrote to memory of 1332	5752	kUIxmmi.exe	92
PID 1332 wrote to memory of 2908	1332	kUIxmmi.exe	93
PID 1332 wrote to memory of 2908	1332	kUIxmmi.exe	93
PID 1332 wrote to memory of 2908	1332	kUIxmmi.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kUIxmmi.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kUIxmmi.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kUIxmmi.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kUIxmmi.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-01_7e28e0149294112ccfcb5fe120eecb3f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 796
        6⤵
        Program crash
        
        PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2908 -ip 2908
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kUIxmmi.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kUIxmmi.exe
Size 3.4MB
SHA256 411cae4fa0f049464a79aa59772ad4c633a8afa65ab42cce8e9135aeb384d821
MD5 8f9abd3c555476aff7bfc873680f0d43
SHA1 56c36bb7bc4f1dd60302eb5a90ab6d5ae9fafb8d
SHA512 38bbe4d040a0f9bc8b05d5338f5f1a2187452dcea8506a7a50709563b17e0e58ab3845f80b6409afdf27a3b9ca525ca438fc3c5741f65dc2bffe0bc6a1a07c2d
SSDEEP 49152:mNwBzNwrM7qMYdsxxPFkoyoDb/3UYkPUlu1/V:rzO47q4x/dPkMlW/
TLSH
T162F5DFE39EF711329ED9CF24B28611611318EA2EDC8BC280EF5769561740B5BED2079F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-29-0x0000000077208000-0x0000000077209000-memory.dmp

Download

memory/1332-27-0x0000000077208000-0x0000000077209000-memory.dmp

Download

memory/1332-33-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/1332-28-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/1332-21-0x0000000077208000-0x0000000077209000-memory.dmp

Download

memory/1332-26-0x0000000077208000-0x0000000077209000-memory.dmp

Download

memory/1332-25-0x0000000077208000-0x0000000077209000-memory.dmp

Download

memory/1332-23-0x0000000002720000-0x0000000002721000-memory.dmp

Download

memory/1332-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1332-24-0x0000000077208000-0x0000000077209000-memory.dmp

Download

memory/1332-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1332-19-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/2908-30-0x0000000000900000-0x0000000000999000-memory.dmp

Download

memory/2908-32-0x0000000001350000-0x00000000013EE000-memory.dmp

Download

memory/2908-35-0x0000000001350000-0x00000000013EE000-memory.dmp

Download

memory/5328-0-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/5328-4-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/5588-2-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/5588-16-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/5588-14-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/5588-1-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/5752-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5752-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Download