50452f9771df1b86e1604254af73f7c562811dc1dec1e4b5334d2e2fa9734778

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_84cf46c48ebd838545e0353da75da016_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 3.9MB
Sample260704-shb3yscx2n
SHA256 50452f9771df1b86e1604254af73f7c562811dc1dec1e4b5334d2e2fa9734778
MD5 84cf46c48ebd838545e0353da75da016
SHA1 a2fb7fe30c692033955a8c7002edbf2143b9c10f
SHA512 f50d72b94c00d35606d58e4747b3ac085672e742701340a62255c056911b3eb0bb9502625fff175e3e04399724053e8c879c970b418013736b0d40962faa5dc1
SSDEEP 98304:emSWOiIyUhO+V/k1L3NbcRbFVLUjH5oxFbx:eXHzsN3NbcRRVUjZEd
TLSH
T1C816F193EB818AE8E29D447A6F554245D62EF621A70F6312399C020DCF473CB8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3388	88E2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_84cf46c48ebd838545e0353da75da016_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88E2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3388	1548	2026-07-04_84cf46c48ebd838545e0353da75da016_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-04_84cf46c48ebd838545e0353da75da016_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_84cf46c48ebd838545e0353da75da016_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\88E2.tmp
  "C:\Users\Admin\AppData\Local\Temp\88E2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-04_84cf46c48ebd838545e0353da75da016_amadey_elex_glassworm_njrat_smoke-loader.exe AA4C4539082CA1CA2E96063E49D2CD6D2D43BBF4623A8FDFFBBCBBE50F124B4B526C6EDFFE2EBD39A39D626B56FE0229FAD88F4597842EAB09D8B60431F75DBC
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

88E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\88E2.tmp
Size 3.9MB
SHA256 ecad062228c35c94a86a7adaad0b4fddcbf6db680c99987113c042195f94592e
MD5 baa76180d9e6be5a181825a77cf8d8d5
SHA1 26b82c7bc60ca784ad3f94d1cf9be8a13b03d156
SHA512 513dbbdd14a754d548ad1a3c4b18d02065d06a0719211a625dd3591478199803a93aaae927615c7763c9e6db744f9ea3462f78cc915fd7d6e4e65383fbe797c3
SSDEEP 98304:emSWOiIyUm1JJXwiwy8jjqkSIVLUjH5oxFbx:eXMiYQekSIVUjZEd
TLSH
T17416F0A3E7818AE8E68D44766F554245D62EF621A70F6312399C020DCF873CB8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download