bb6d6d1870e86aae78a252ebea009d97a1d48c49388efa0514936d9b0d6f5c97

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:44

Target
2026-07-09_f173fa4bcadcf9ff7c2fbe1adf58d474_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.6MB
Sample260709-xdjdpagy3z
SHA256 bb6d6d1870e86aae78a252ebea009d97a1d48c49388efa0514936d9b0d6f5c97
MD5 f173fa4bcadcf9ff7c2fbe1adf58d474
SHA1 4ae2ba9a4d1e6fdc98b20ca84cb5349d22de73b4
SHA512 a60d7e1bd0b67bd5106503ab1bd0d44985a95712f426b8cf2198a7b1de65d1a6dd80029c280565a9884b1600d2bab994116e57946f7416c445661519f48de538
SSDEEP 196608:Qo0PyScaWWi7pQSWe7cCRC//YfYa0rh25M:NiHcaWWi7iSWWcCRCwR0l25M
TLSH
T15EB69D32B245C036E5A011F1981FAA1A63347A79137088CFF5E59E6E22F56C74B36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/3284-0-0x0000000000C40000-0x00000000016E7000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3284-0-0x0000000000C40000-0x00000000016E7000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4816	3284	WerFault.exe	85
4904	3284	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f173fa4bcadcf9ff7c2fbe1adf58d474_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f173fa4bcadcf9ff7c2fbe1adf58d474_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
PID:3284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 248
  2⤵
  - Program crash
  PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 244
  2⤵
  - Program crash
  PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3284 -ip 3284
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3284 -ip 3284
1⤵
PID:3768

memory/3284-0-0x0000000000C40000-0x00000000016E7000-memory.dmp

Download