67aa2b30e3df396d50cc720180895c3139ed30d2bc28b7e3e2a70fb35de18f21

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260707-tr6vcsas2l
SHA256 67aa2b30e3df396d50cc720180895c3139ed30d2bc28b7e3e2a70fb35de18f21
MD5 47a3bf83a316622af4fe6a2a0f9fce71
SHA1 bcd499a7a6597e33e89afd23c795384f18bd0a08
SHA512 fcb18f4fffa411a00fff84b7b99e9fc695d08e082c72cc8baadb719fdb9f45b11ae36dcd3febcbafc0736ea2211f0a8557215f5e932cf5dcd9b9838a192ebebd
SSDEEP 49152:z9x+EbaWOhz33/wLXwxXxUrcLf6vj0OXFz9wvJpGVb:z9x+EbaHhzbB+rdLVrwvJpG
TLSH
T1C316BE5B6442B061F4D230746D6FEE6E293811111FF96EF722E310AF2A948D56B3363B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v42dDeF4KZE.exe	2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
3680	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	3584	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v42dDeF4KZE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v42dDeF4KZE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
4584	v42dDeF4KZE.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe
3584	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2984	2244	2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	88
PID 2984 wrote to memory of 3680	2984	2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 3680 wrote to memory of 4584	3680	v42dDeF4KZE.exe	91
PID 4584 wrote to memory of 3584	4584	v42dDeF4KZE.exe	92
PID 4584 wrote to memory of 3584	4584	v42dDeF4KZE.exe	92
PID 4584 wrote to memory of 3584	4584	v42dDeF4KZE.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v42dDeF4KZE.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v42dDeF4KZE.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v42dDeF4KZE.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v42dDeF4KZE.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-07_47a3bf83a316622af4fe6a2a0f9fce71_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 752
        6⤵
        Program crash
        
        PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3584 -ip 3584
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v42dDeF4KZE.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v42dDeF4KZE.exe
Size 3.4MB
SHA256 1c50a7287ab34564f6c572cb15dca7e0a3c1ebea06d4894f282d625d1dc0191a
MD5 b324e4cb4676b7c8ee256d8af5c72eb0
SHA1 274534593e6f8aa89ea39f390e9d77046ddd4c6e
SHA512 aacff7902d96aaa466675e2e1ae9a94e1807c3d767ec77e038650845cac0be5cd9c2b974a3d08f5c149cfe048051f0885eef8e682b03545f553bb1332521d904
SSDEEP 24576:1HkzcQXZLO2kAFAu+J6PYVY+Q625HJZnlNrJTTlBOesnTwi+GSD:ycp2kqg3Qz3nlN1TfOeBPGS
TLSH
T195F5CE6DAAC7C0E4A861D8B45C466B1DFE36128E7188F93E5F3CD80A67C329727F5421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2244-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2244-4-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2984-1-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2984-2-0x0000000002B80000-0x0000000002C1E000-memory.dmp

Download

memory/2984-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2984-18-0x0000000002B80000-0x0000000002C1E000-memory.dmp

Download

memory/3584-36-0x00000000015E0000-0x000000000167E000-memory.dmp

Download

memory/3584-34-0x00000000015E0000-0x000000000167E000-memory.dmp

Download

memory/3584-31-0x0000000000C70000-0x0000000000D09000-memory.dmp

Download

memory/3680-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3680-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4584-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4584-25-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/4584-24-0x00000000778F8000-0x00000000778F9000-memory.dmp

Download

memory/4584-27-0x00000000778F8000-0x00000000778F9000-memory.dmp

Download

memory/4584-26-0x00000000778F8000-0x00000000778F9000-memory.dmp

Download

memory/4584-28-0x00000000778F8000-0x00000000778F9000-memory.dmp

Download

memory/4584-30-0x00000000778F8000-0x00000000778F9000-memory.dmp

Download

memory/4584-29-0x0000000000BF0000-0x0000000000C8E000-memory.dmp

Download

memory/4584-33-0x0000000000BF0000-0x0000000000C8E000-memory.dmp

Download

memory/4584-22-0x00000000778F8000-0x00000000778F9000-memory.dmp

Download

memory/4584-20-0x0000000000BF0000-0x0000000000C8E000-memory.dmp

Download

memory/4584-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download