b6567c307ce43fc41e840c27be2d3fdaadc9bd9c4905d6ab1a83e2c2cf3f86c0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_3d99a4cb4878c085ac231d345227bdaf_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 4.1MB
Sample260717-x3ef2ab12j
SHA256 b6567c307ce43fc41e840c27be2d3fdaadc9bd9c4905d6ab1a83e2c2cf3f86c0
MD5 3d99a4cb4878c085ac231d345227bdaf
SHA1 213d195b65b9fb7f5f7d5ee130e38fa35dbb730e
SHA512 da32f59aa510f3d42f44aa1d1bf7d09c1ada6b637dffb166df1aca985a6d86edfec101d140b95d8dd9d6ddd1793d0cd6701a5eba33462aa9391cccf823eb4af1
SSDEEP 98304:pmSWOiIyU3pkH9+obg1uGu7x+UVfVLUjH5oxFbx:pX5WIR1S7oKfVUjZEd
TLSH
T10C16E053E7818AE8E64D447A6F554240D72EF621AA8F6311399C130DCF8738BAF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2168	C375.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_3d99a4cb4878c085ac231d345227bdaf_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C375.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2168	4832	2026-07-17_3d99a4cb4878c085ac231d345227bdaf_amadey_elex_glassworm_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_3d99a4cb4878c085ac231d345227bdaf_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_3d99a4cb4878c085ac231d345227bdaf_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\C375.tmp
  "C:\Users\Admin\AppData\Local\Temp\C375.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_3d99a4cb4878c085ac231d345227bdaf_amadey_elex_glassworm_njrat_smoke-loader.exe 1CBD17A1609730D4AA87C9921D445BF68F9F6ACFD278DFA48F14DAA5B2C65ED435A39613343709361245EF71A13091A0172DAF951967227627FA8BE14F7F38F9
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C375.tmp

Path C:\Users\Admin\AppData\Local\Temp\C375.tmp
Size 4.1MB
SHA256 b6f99a30f68c60982dc20897af939072c7a595ea020acc10edc7045f35c787e8
MD5 d69693f7f9dc2f0d6fbc84298f0f3bad
SHA1 fa2878ae6ff66888b610dd5ad31cca9dc20b8c3c
SHA512 1f9bf75a002f1d123f73aa2b6da8e41a3418937358d008f2aa974d7cdf337ac532904974c53519da4560572a88e5ba5ff8234e225ff996dcb086c46f3c437471
SSDEEP 98304:pmSWOiIyUjDbfG4m11lNhLwOVLUjH5oxFbx:pXhO4mZPVUjZEd
TLSH
T1B616E053E7818AE8E68D44766F544241D72EF621AA8F6312395C130DCF8738BAF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download