96b38a4e689f00c7d8fad2b13fc01cc22e0387d4602702b3c4d3db9cdcfad37f

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_71dc0b8a43c69fe429baa591111ba25f_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 5.0MB
Sample260707-dkcd6sgw6x
SHA256 96b38a4e689f00c7d8fad2b13fc01cc22e0387d4602702b3c4d3db9cdcfad37f
MD5 71dc0b8a43c69fe429baa591111ba25f
SHA1 995d1aeec985805c44c7f6fa715057066eadecb7
SHA512 44b2b30f40279cffe77a9122f6bfe1c673a2caa9ab7d9b3f04ff34af6047666ee43adce3328d74f61012638881b9df43bb1eea2595627608db4ead3960d374ab
SSDEEP 98304:roa1taC0gyR3qq7xlJ8MNXnLrHp/qKm2/Sb/gqAZj:roa3A3q2xlJ1N7rRb/G8
TLSH
T14936DF53EBD24AE8F28D05366B544140D72EEA21964F132234AC225DDFA73878F75E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5484	2428.tmp

Executes dropped EXE 1 IoCs

pid	Process
5484	2428.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_71dc0b8a43c69fe429baa591111ba25f_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2428.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 5484	4380	2026-07-06_71dc0b8a43c69fe429baa591111ba25f_amadey_elex_glassworm_njrat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-06_71dc0b8a43c69fe429baa591111ba25f_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_71dc0b8a43c69fe429baa591111ba25f_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\2428.tmp
  "C:\Users\Admin\AppData\Local\Temp\2428.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_71dc0b8a43c69fe429baa591111ba25f_amadey_elex_glassworm_njrat_smoke-loader.exe 3DFBE631A75B0B4F29AFF5997A728D52A6D5295537F1907C989AABB27882B7C8270274C8266F522AFA2C1A55136B5FD234D8AACC6785106E618305E700053CBC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2428.tmp

Path C:\Users\Admin\AppData\Local\Temp\2428.tmp
Size 5.0MB
SHA256 d3deda905a3f4f5fad6a687ec4b2a61237f224ae58609c308633fae65933e5b9
MD5 7dd0e24d6fb6b7106fbc50dd26923dcf
SHA1 4236ea62fb368991a9149eaef3946082c8033ca7
SHA512 3eb59f3de75aa35e9c6239ea95c27f08c0a2557e738c1474b58d1479b38e271c10df17bc25bc48b7f5656d5d917a12af25d30f0d272d9506ba0b53e00b38e11d
SSDEEP 98304:roa1taC0Au1jqQmgI3IMNBfFNRDnLrHp/qKm2/Sb/gqAZj:roa3QqQmgI3IINFNprRb/G8
TLSH
T16636DF53EBD24AE8F28D05366B544140D72EEA21964F132134AC229DDFA73878F75E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download