7cdad7132f890b2b740f9227636f33cb71311daff437e05ce134609876c536cd

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_efeea88db44251915adbb3313506ca07_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260718-glb2kshx9j
SHA256 7cdad7132f890b2b740f9227636f33cb71311daff437e05ce134609876c536cd
MD5 efeea88db44251915adbb3313506ca07
SHA1 7778b76fdc14f1b91fc206e492ba36ae96266dee
SHA512 0bcb116fd8ccb8235c5afdabc9a72ee55c92200347e03f0db525dafbef0ca61ab16427ebd3f0c5bc2de130e1cb244fd493a234d40139240caa0bd52f8ee74fd5
SSDEEP 98304:50nAAYEpsh29OU/jIEeQfoR/IuOFVjUu53:eNr9FIF0wul
TLSH
T14CF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2936	original_temp.exe
3328	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_efeea88db44251915adbb3313506ca07_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3328	original_temp.exe
3328	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2936	4908	2026-07-18_efeea88db44251915adbb3313506ca07_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2936 wrote to memory of 3328	2936	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-18_efeea88db44251915adbb3313506ca07_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_efeea88db44251915adbb3313506ca07_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\jds240737937.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240737937.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5AAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5AAA.tmp
Size 1.1MB
SHA256 f01133d63ba53fa691b91be83a3fbad075ea1e76cdee91cd9d005fc0feaa60d4
MD5 a4cdf45d2dd96f434ba41a62cd13a485
SHA1 10be51937665a2dd88e8fce7438cbc104301788a
SHA512 275977e277ee2182c79f04a9f02fe3b0522f7e09a08cc7951b177fe12ed817bbc2287551db4b90c3564b53434c56ced98c8e565a9dd68e0134fd989a79ac5186
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6YA+w91:W6F0eMpAAYEhpshw/
TLSH
T1E4456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5DAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5DAA.tmp
Size 1.1MB
SHA256 1eda1b481d77166c336b00590e78baa0b13750c5dded51c67283ace670469548
MD5 0a3a46337d5bd4b5d6870372fd8db5cc
SHA1 df1a39dad9393df75bb906cddd6d25c6a199c82f
SHA512 9ba92542eec8ab11fb3f7891970ded6780501e0758cfffaee269336ed42c76e882b9da1e00934d443fa78bacb75778f6bef0775f0708e39e9a28bd8b970b3180
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+w9d:+6F0eMpAAYEhpihwn
TLSH
T1B4456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240737937.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 6bd7d826d4bd02acd64a5678261ace8bf9580fbdca5e552d877d76a17a03c929
MD5 0bd1e3ded013629d84a2abe3f300c482
SHA1 3f404b93140338f7e84d0352e2c07fed0b1bfa63
SHA512 7cd5a6bfee8bd9f54b491799d2bd10df9e35037ae14c20573c9f5e083c20e6c90532507fd40cdd5832622d1bb7c55a1acd79ab9dba7f192ad20bf8b1c0ab9104
SSDEEP 3072:LAmxBw9mYXcxUqjVPf5Q9xl7opT44aJNwo5NEFfAHeb:i0CK
TLSH
T1EDF32496851F48FB24138B97C379AC7445A6254E475E4A2933CFC2AEB241907CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 6f4bbc58a8ded55e1ec16da5a5e8380b4e3ec3efd079a7007deba03ac39ef85e
MD5 33219eb54542d3de8cf97080cb642f46
SHA1 35114c2527becd159ed635c347bc63745c04f1d9
SHA512 32e41555696902cfe1be5d35c359098eb8122a5894b7c061f1cb1cb8688f28069b5159015b38121a62058b3a9b41a899286a9e9f81c03dd1f333edf035d74b62
SSDEEP 3072:LAmxBw9mYXcxUqjVPf5Q9xl7opT44aJNwo5NEFfAHes:i0C7
TLSH
T1A4F32496851F48FB24138B97C379AC7445A6254E475E4A2933CFC2AEB241907CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 23ac2ad60d555d6cec657e8db6e4bef7612141c4c13a28ce61cd0a68a7749f35
MD5 ed234ed07803b4f897fa14f3ff692955
SHA1 288fb8c0ebde3ff2ae1eaae6efbe5bd0793d2d03
SHA512 ce332d78c925909e991ae7f17a1798c6249bffe9dd269fa83c9bcebaebac30444d017000d3e7ec587a6214b080f6ad4c6c29f683fff5e9a8852816b9915b5b33
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUYA+w8/:W6F0eMpAAYEhpyhwm
TLSH
T1FE456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 94b2fdf43602224de8c84ee732574fb9503339ce47467c44eef8b2041683861e
MD5 5a04ed5aa7451409bfa9e40a58a5f2c2
SHA1 479b99c75d7353b62803d3f5cdc8d6d2e6b31ee0
SHA512 ab60ecb657063f4ac393712c9ef2562b8e36a67e9a20faa20970d3d200851c709068e7e449d4755b29f717eaf9b2b8946cac79ca7a65dacecd662698cb3f8a78
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+w/h:96F0eMpAAYEhpehwJ
TLSH
T157456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4908-265-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads