c32db710ec1d8137a3a8d6346103ed7ff592ed6d69737b5d742605473d3cc1e0

General

Target
2026-07-08_79ddf9255767676173741260c649ea69_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260708-e4sqyaay61
SHA256 c32db710ec1d8137a3a8d6346103ed7ff592ed6d69737b5d742605473d3cc1e0
MD5 79ddf9255767676173741260c649ea69
SHA1 f40ab59eee5587a434c5d419242c0bfb325fc104
SHA512 5b35f07d9981e405998ba4c9a26d27ab5364dd3d241627ce973ea19bc535af504ea7d212b17fcb6721c9e701db8c7315b90141be815f6820f775d77c922b0c41
SSDEEP 98304:p0nAAYEpPh39OU/jIEeQfoR/IuOFVjUu5t:uNT9FIF0wuf
TLSH
T1B7F59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4620	original_temp.exe
4748	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_79ddf9255767676173741260c649ea69_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4748	original_temp.exe
4748	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4620	4564	2026-07-08_79ddf9255767676173741260c649ea69_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	87
PID 4620 wrote to memory of 4748	4620	original_temp.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-08_79ddf9255767676173741260c649ea69_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_79ddf9255767676173741260c649ea69_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\jds240650281.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240650281.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4CE.tmp
Size 1.1MB
SHA256 19afb56ef15dcd5f97c87e3ceb7ec4da1e314731fb353a390717e689d834d54f
MD5 09e3b2eb27a28e57579844b7ca2366a8
SHA1 ca44a6303806889960839ec059b7893af8aee78f
SHA512 846c7044dbbeea9b3a997f8fab9c98436ea33f62535a35d1fc229c42e088674d822227d2ef342b0a8f78b8e364878602f5f2ce8068b52bd2846e3d6ef34b3d4f
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjYA+wcD:G6F0eMpAAYEhpPhwy
TLSH
T12A456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6D3.tmp
Size 1.1MB
SHA256 785ae38b5589edf7a4085c638813cceb88399c3ac5e6bd7d4a073228a6fd6958
MD5 78fc0ef54210c1c377e5a0b9b88aa6df
SHA1 b5143d8c4e36c65d583ddf9636936fd519ab9815
SHA512 f7501a62b8d4e92e7092645db96b490dfc762b4c37d1c7a76539998c693249aaee7d300dfd17abe6140b5d9b314f9afd74859b78fa5bd56d6f43024158de86ac
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wh+:V6F0eMpAAYEhp9hw0
TLSH
T19B456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6D4.tmp
Size 1.1MB
SHA256 0066efc60814ae6b5e1c8e790cfecc841ff8b99eb1fdf17f70ce15eded907d0b
MD5 02405fbbe7485567434ca5e5927e9ebf
SHA1 fd4ee66aee9668ef95213b0f595ac40461a25214
SHA512 c5123f7d18800ce0dd98f50732f9bd3d0d183d5651fbd3ff086946d282cbaa8970460d960c522451a79bd8e2f79a23171cab4bde6aed14f3a8328a446c990a1c
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtYA+wcr:66F0eMpAAYEhpFhwa
TLSH
T144456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240650281.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 16093dd247d9a6347a6e8255a43dab24e49a65b71b04f45658b857dcd69b1d40
MD5 9f5da4ca341f210c0c7db6d06e5fe661
SHA1 a4cd5e4a0110570388767840dbedb826aa8b2ed1
SHA512 4934dec520677349677895480ec026309601ed785a69814034495616f0e170c278236bc635cbbb6f15cf1b523ae4945f35badbce46845e629273fcd580190157
SSDEEP 3072:TM8NrmL+s+U6IV4Bi0l7yf6wz2o//x8DCDBdiT6o4+c:tJl6
TLSH
T15DF33487891F44BB28634AD3D36A5E549792150E53EE091C31CFC2EAB845C17CA7E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 1692e9f5238c8b0c5c3aec64dabcf5fef5fdf05381256e6c54067fd7009829f6
MD5 f6a03a7aad15025cc6f6812348a70502
SHA1 3d586c706e4c3bc7555711414dcfa411701c102e
SHA512 e1153f32af6cc4bcc1c7cd2d4adaa968a6b101e5c361dd0e71b2933ca873147dbfa5915352bf8ff9df9bca38df6e4718e89a01330e9531c4a006b59bdf10bb82
SSDEEP 3072:TM8NrmL+s+U6IV4Bi0l7yf6wz2o//x8DCDBdiT6o4+q:tJl0
TLSH
T172F33587891F44BB28634AD3D36A5E549792150E53EE091C31CFC2EAB845C17CA7E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4564-427-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads