1d707cbed35770b3335c1686e445ab4cc6d50debc3a4f855c266a650e02f710d

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_98f776912c6519c33385eb1b296cc624_elex_glassworm_mafia_njrat_stealc_tofsee.exe
Size 935KB
Sample260714-xdfb2abt7l
SHA256 1d707cbed35770b3335c1686e445ab4cc6d50debc3a4f855c266a650e02f710d
MD5 98f776912c6519c33385eb1b296cc624
SHA1 38f24f651f46fcb1fbbc1d621d0e31d2609cba06
SHA512 16894af87ff45072a71b55e3358b952e7d3a79d084a73bfa28789d18e2f560a70a505d564c3187f688ecb2cf040479c91b9dbeb0ad1b2abcd65d4687a261b4cf
SSDEEP 12288:Xb4bZudi79LPgTljuK7FTHW5k55ePAIXmt0LDH4L:Xb4bcdkLPyMK7FTHh5Y4
TLSH
T19715BFA5EA9AC0F1E3760A300BE08310B7B2FCE41B515A5FA1FD527F2C954D1EF61626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4108	3E38.tmp

Executes dropped EXE 1 IoCs

pid	Process
4108	3E38.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_98f776912c6519c33385eb1b296cc624_elex_glassworm_mafia_njrat_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E38.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4108	4668	2026-07-14_98f776912c6519c33385eb1b296cc624_elex_glassworm_mafia_njrat_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-14_98f776912c6519c33385eb1b296cc624_elex_glassworm_mafia_njrat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_98f776912c6519c33385eb1b296cc624_elex_glassworm_mafia_njrat_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\3E38.tmp
  "C:\Users\Admin\AppData\Local\Temp\3E38.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_98f776912c6519c33385eb1b296cc624_elex_glassworm_mafia_njrat_stealc_tofsee.exe EA05C17DA4F71A62002DC9FD18E10829FAB9862575503967CDA713A143AAC90B4AF7D0640586489632EC379FC979C0CC895B8E044523DA163A93B38F5B0E982A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3E38.tmp

Path C:\Users\Admin\AppData\Local\Temp\3E38.tmp
Size 935KB
SHA256 26ce14df159e79aee4baa94d098739bee01cacee899b40b28036b415ec5e78c4
MD5 bfea7a5fd16c9c5df4ed185c1328abc1
SHA1 d4246e52b67b5d8af03c636c2859ebf4c6945a19
SHA512 a91de7cbde95773411246e382e426b492091d736d3d440e4ac7f40010ab28bb9ca4943736732440fe91ac8780281ae532e048f971d396f3faada5e19eb65b4d9
SSDEEP 12288:Xb4bZudi79L5mgxuzPTqPeFEdZfbuYbAIXmt0LDH4L:Xb4bcdkLElCP4EPbx4
TLSH
T10915BFE5EB9AC0F1E2660A340BE0C310B772FCE41B515A5FA1FC526F2C954D1EF61A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download