d7feea40a0909b77bf4ced2e093f511379d69c25fcb1c836783fc8c7af99a2b9

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_03d5a51c5c3d0fc13f496569620a97fc_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.5MB
Sample260704-yk13rac16w
SHA256 d7feea40a0909b77bf4ced2e093f511379d69c25fcb1c836783fc8c7af99a2b9
MD5 03d5a51c5c3d0fc13f496569620a97fc
SHA1 c82984e9d554ddddf1c7799e9c8ae0b267dc0bd9
SHA512 c21edae3f23f52e81b865876099113fd78774c6212c4b62501c9357cdd3ca06916d5bb52587a46e98fd35952c743a15eba2cfed694d56b1c640243345c1cf6c1
SSDEEP 49152:2oa1taC070UIip8gZMtg22RO+HWtwMaKt+tDtfSeAOV:2oa1taC0L2gZz22BNzKI1G
TLSH
T1C4C5DFA3E7918AE8E68D04766F544250D62EF231AB0F5712799C120DCF837878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2764	FA0B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2764	FA0B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_03d5a51c5c3d0fc13f496569620a97fc_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA0B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2764	1828	2026-07-04_03d5a51c5c3d0fc13f496569620a97fc_amadey_elex_glassworm_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_03d5a51c5c3d0fc13f496569620a97fc_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_03d5a51c5c3d0fc13f496569620a97fc_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\FA0B.tmp
  "C:\Users\Admin\AppData\Local\Temp\FA0B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-04_03d5a51c5c3d0fc13f496569620a97fc_amadey_elex_glassworm_njrat_smoke-loader.exe 83AD1B87740919EA8CA2C3E95A1A866AD69FA29C3BD7871DD7FC1A2B2011662848485F6CDB467FEB6DA29D746ACF38BD39B1E6D36E98D05A280BFF5D54CA0938
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FA0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\FA0B.tmp
Size 2.5MB
SHA256 f6a1d048463afc63131ed16d11a5e6bacd49c1a9ba3540f69a5bc645d8ee212f
MD5 d1cf76713cf92673cddb7e4ac9de72c5
SHA1 097b7f59bd08741bb16b680f6ed4e16b50a5025e
SHA512 7bd5fff8e1138b792c8d9707de1675ccae6e355984a1e73cadeae80bb3ba6828cba716ca691b722673a761ded7b24edd27dd08fd457d562a5e70f7be369b3985
SSDEEP 49152:2oa1taC070UHE5W0U8qw4oyJzpnQXr+bbOTtwV:2oa1taC0BE5W0U1mwQXr+Kh
TLSH
T122C5DF63E7918AE8E68D04766F144241D62EF221AB0F6752789C130DCF8778B8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download