7328717f2a020bc9e91f63f82e3d8cd6235afc6936359f0e2afec3427ca7e4fb

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_379ba3e38f5401c4fa4b5b5627053055_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.5MB
Sample260707-3fbdragx3p
SHA256 7328717f2a020bc9e91f63f82e3d8cd6235afc6936359f0e2afec3427ca7e4fb
MD5 379ba3e38f5401c4fa4b5b5627053055
SHA1 af7e36a20e9169210e95763592f4eadb0e851447
SHA512 1d5111d0490c47486dcc6b6903b0d84a82f5ac8c987d367fe4e1d6d21fcb14e256dded2c2529f1795bbd7419df13fe977907d251520ac289124a6faf3f9a6ed4
SSDEEP 49152:2oa1taC070UoIRvvcZWspbbmd6EZlVcV:2oa1taC0awvvcZVbmAE
TLSH
T109C5DFA3E7918AE8E68D04766F548241D62EF221A70F6712799C130DCF4378B8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2360	45D9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2360	45D9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_379ba3e38f5401c4fa4b5b5627053055_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45D9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 2360	5888	2026-07-07_379ba3e38f5401c4fa4b5b5627053055_amadey_elex_glassworm_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-07_379ba3e38f5401c4fa4b5b5627053055_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_379ba3e38f5401c4fa4b5b5627053055_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Users\Admin\AppData\Local\Temp\45D9.tmp
  "C:\Users\Admin\AppData\Local\Temp\45D9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-07_379ba3e38f5401c4fa4b5b5627053055_amadey_elex_glassworm_njrat_smoke-loader.exe 5231923CE3EA14BEDE01DB01F8C628DA05608249C6673C5672F6E65E466A8257EC1D6387708CC9A28F6DDB11758F2A51EB025E2A4AB00EBB80B5F3125AF8B879
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

45D9.tmp

Path C:\Users\Admin\AppData\Local\Temp\45D9.tmp
Size 2.5MB
SHA256 d0c80f6016411aa04a3fa95935ec178083c84be3b7cc18d0b9bd246fd4bf3c0c
MD5 bf55a785c4624841d73d3500700bab3c
SHA1 fda40eca22dcb3d84b3f701ee5bc997852a319dc
SHA512 f9b8ee7406acc44ceb0a883f4bccc2b06d8d3233a8598cb67f0ec78c025e54ac40b8541f4e4674a62a4866e911641026f220b7417a31088aba929f58555c44d4
SSDEEP 49152:2oa1taC070URkgbUm6cTxD5VJtNoQDcQwwiXNcV:2oa1taC0rkDkptNowti
TLSH
T136C5D0A3E7918AE8E68D04766F544241D72EF221AB0F1752799C120DCF8378B8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download