c05b08817e464203bac10f64576dc596b828b0eb7d4b168cc2910db1a83b2354

Analysis

max time kernel
148s
max time network
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260703-xfb3dsa13j
SHA256 c05b08817e464203bac10f64576dc596b828b0eb7d4b168cc2910db1a83b2354
MD5 df1d57361488f19d29fbce0e88e12abb
SHA1 f001535be1701952ed5a472302a298c7483d129d
SHA512 4002c94632b433c92816df3ebd361c51bb65f5e321dbddfc62d5a24fc21219f33ecdf74a815def385dc569aa25b9770484f3a8f7e5c818890003bc6cff5c5ec0
SSDEEP 98304:7VrwvJpGxEVQvhQECL7kHkXum+9DdTToYYcDCTDpY:7bEV4hQECLDJ+9xXZnDCvS
TLSH
T140161213A5D28163F2D202B8ABF5E7B74E2DD323672AE4C7F29314A55E234C2353564E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3600	cmd.exe
4	3600	cmd.exe
5	3600	cmd.exe
6	3600	cmd.exe
7	3600	cmd.exe
8	3600	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pw51arNv1.exe	2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2040	Pw51arNv1.exe
4704	Pw51arNv1.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
8	3600	cmd.exe
8	3600	cmd.exe
7	3600	cmd.exe
7	3600	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pw51arNv1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pw51arNv1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
4704	Pw51arNv1.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe
3600	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 5996	1272	2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	88
PID 5996 wrote to memory of 2040	5996	2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 2040 wrote to memory of 4704	2040	Pw51arNv1.exe	91
PID 4704 wrote to memory of 3600	4704	Pw51arNv1.exe	92
PID 4704 wrote to memory of 3600	4704	Pw51arNv1.exe	92
PID 4704 wrote to memory of 3600	4704	Pw51arNv1.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pw51arNv1.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pw51arNv1.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pw51arNv1.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pw51arNv1.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_df1d57361488f19d29fbce0e88e12abb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pw51arNv1.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pw51arNv1.exe
Size 3.4MB
SHA256 1635f9c3b9b0eb0e3b87a470b03cc15a439507eab7bec703c1a92f2886986c10
MD5 a7ace1c4aa3044be545999c1fad03832
SHA1 64f2381464f76e849350dac60123b6ac096641be
SHA512 9215ac9d1ededb7a1c50266312f9246aab4fa094d22e64eeb0b54554267a8650436449104cba78c17a3a7cda61e432c101d803a0d195ecc3c8c130d512729443
SSDEEP 98304:xf92JzXuDNFFjlHheSIyOP1wPXDQCgG6AFPJGTDSAqlaeJ:xf8JDuHbhBIyOdw/ECTJGf2ae
TLSH
T130F522730C30125BE7BBA2312F035972740484FDDA26679ADBAC1F9F2435A64F6E45E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1272-0-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/1272-11-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/2040-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3600-35-0x0000000002390000-0x000000000242E000-memory.dmp

Download

memory/3600-34-0x0000000002070000-0x0000000002109000-memory.dmp

Download

memory/3600-33-0x0000000002390000-0x000000000242E000-memory.dmp

Download

memory/3600-32-0x0000000002390000-0x000000000242E000-memory.dmp

Download

memory/3600-31-0x0000000002390000-0x000000000242E000-memory.dmp

Download

memory/3600-27-0x0000000002070000-0x0000000002109000-memory.dmp

Download

memory/4704-22-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/4704-21-0x0000000077E78000-0x0000000077E79000-memory.dmp

Download

memory/4704-23-0x0000000077E78000-0x0000000077E79000-memory.dmp

Download

memory/4704-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4704-25-0x0000000077E78000-0x0000000077E79000-memory.dmp

Download

memory/4704-26-0x0000000077E78000-0x0000000077E79000-memory.dmp

Download

memory/4704-20-0x0000000077E78000-0x0000000077E79000-memory.dmp

Download

memory/4704-29-0x0000000002C00000-0x0000000002C9E000-memory.dmp

Download

memory/4704-19-0x0000000002C00000-0x0000000002C9E000-memory.dmp

Download

memory/4704-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5996-17-0x0000000002670000-0x000000000270E000-memory.dmp

Download

memory/5996-14-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/5996-1-0x0000000002670000-0x000000000270E000-memory.dmp

Download