264879dba739ca1b7bf8ca392be1cb07bbfe6e0a9a5d67b07f6fa4b94827cedd

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260715-bbp8kagy2n
SHA256 264879dba739ca1b7bf8ca392be1cb07bbfe6e0a9a5d67b07f6fa4b94827cedd
MD5 3b981466ac39254a5327968a03610a20
SHA1 1d7abdef298de628c67416d54b58adb0bb30a680
SHA512 bb4fc12a632e2c0886c3ea5c56457b0e13bbf3e62c671187517c33679f064227811b6f4cefbebdbb3ab21778dedab411998f8d14bbb4ef1c8e086f96f2091fcf
SSDEEP 24576:CA0tUXF2K2iMMfwoiJpGVFp5nOXm+M81GB+5ZFOSCHmhye/RiElaaYlCnp:L0OXFz9wvJpGVb5l+1e+SJe34a
TLSH
T163169E115A4C91F1E0BAF037726E46B639182325239BE0C36294EBD7B7520D1A73E97F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kljZXtIGhzlDB.exe	2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
4100	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	3312	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kljZXtIGhzlDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kljZXtIGhzlDB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
2672	kljZXtIGhzlDB.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4192	4432	2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	87
PID 4192 wrote to memory of 4100	4192	2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 4100 wrote to memory of 2672	4100	kljZXtIGhzlDB.exe	90
PID 2672 wrote to memory of 3312	2672	kljZXtIGhzlDB.exe	91
PID 2672 wrote to memory of 3312	2672	kljZXtIGhzlDB.exe	91
PID 2672 wrote to memory of 3312	2672	kljZXtIGhzlDB.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kljZXtIGhzlDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kljZXtIGhzlDB.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kljZXtIGhzlDB.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kljZXtIGhzlDB.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 788
        6⤵
        Program crash
        
        PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3312 -ip 3312
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kljZXtIGhzlDB.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kljZXtIGhzlDB.exe
Size 3.4MB
SHA256 237452a337b63c5eac9cfb83e4001f75123223e1ec6d52bf6de02473eb515e90
MD5 17865d38fc1c60deb39e90aa4c5203c3
SHA1 b766dc919e3049d3bd607b6f21681d378f193de0
SHA512 8fe089527d6d0419ebb3a50decf30512d351d36011fe68344a2620411f13e507c3d0f4014c97aa6453dbb097a8211e6ab66962abd8f5ad96453e73e2d59355f6
SSDEEP 24576:ljs/V2znOtuEcbEjCq6JTM5yTtmXaySMHdyQ+1owISdtkkEk+x:lIQLIuEcbM6C5y0P+CwISUkEk+x
TLSH
T1FFF5CED30F36BC2D856E9E254FB4A68B2E38F7C5829F796B0624DB480741EB3917604D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2672-29-0x0000000077EB8000-0x0000000077EB9000-memory.dmp

Download

memory/2672-19-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/2672-33-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/2672-28-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/2672-27-0x0000000077EB8000-0x0000000077EB9000-memory.dmp

Download

memory/2672-26-0x0000000077EB8000-0x0000000077EB9000-memory.dmp

Download

memory/2672-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2672-23-0x0000000002760000-0x0000000002761000-memory.dmp

Download

memory/2672-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2672-25-0x0000000077EB8000-0x0000000077EB9000-memory.dmp

Download

memory/2672-24-0x0000000077EB8000-0x0000000077EB9000-memory.dmp

Download

memory/2672-21-0x0000000077EB8000-0x0000000077EB9000-memory.dmp

Download

memory/3312-30-0x0000000000D60000-0x0000000000DF9000-memory.dmp

Download

memory/3312-32-0x0000000001A60000-0x0000000001AFE000-memory.dmp

Download

memory/3312-35-0x0000000001A60000-0x0000000001AFE000-memory.dmp

Download

memory/4100-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4100-15-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4192-17-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4192-2-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4192-13-0x0000000000400000-0x00000000007FD77F-memory.dmp

Download

memory/4192-1-0x0000000000400000-0x00000000007FD77F-memory.dmp

Download

memory/4432-0-0x0000000000400000-0x00000000007FD77F-memory.dmp

Download

memory/4432-3-0x0000000000400000-0x00000000007FD77F-memory.dmp

Download