3e069b203f2021ebd6aeb2a80b6fccb274c40567f7e7cff71363dfa66a431ac8

General

Target
2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Size 2.8MB
Sample260712-vramlaf12x
SHA256 3e069b203f2021ebd6aeb2a80b6fccb274c40567f7e7cff71363dfa66a431ac8
MD5 4e1f4551c9c3bb62cbdc5484d0db5184
SHA1 e55d684e579310e9916503104c2ce008ecdf16d5
SHA512 4b093cc2bd70c78dc34389b5822adcf9c5e3c2d1ab6d9dd9c6dd34d8876f13825bd72d6725c99889f8fa97433854eb2659fa53ca6399c9313a744799d2aef5a4
SSDEEP 49152:asQqp8Ay5PMpaOjPufBp3ByKB33Ma67NreT6scPEWcylvJbXDmg27RnWGj:qquA8PQaOjPuZp3ByKB33Mx7NrpstqD6
TLSH
T1E6D5CF12BA42C072E59201B452FA6B7FCC3AA934573485C397D01E7999312E37B3E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3300	netsh.exe
124	netsh.exe
5488	netsh.exe
4252	netsh.exe
5552	netsh.exe
2732	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3796	4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	87
PID 3796 wrote to memory of 3300	3796	cmd.exe	88
PID 4796 wrote to memory of 3384	4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	89
PID 3384 wrote to memory of 124	3384	cmd.exe	90
PID 4796 wrote to memory of 1164	4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	92
PID 1164 wrote to memory of 5488	1164	cmd.exe	93
PID 4796 wrote to memory of 4236	4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	94
PID 4236 wrote to memory of 4252	4236	cmd.exe	95
PID 4796 wrote to memory of 5312	4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	96
PID 5312 wrote to memory of 5552	5312	cmd.exe	97
PID 4796 wrote to memory of 1408	4796	2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	98
PID 1408 wrote to memory of 2732	1408	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_4e1f4551c9c3bb62cbdc5484d0db5184_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="upWire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="wire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="wire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2732