9978e78aaf4866456cdf0d38eca411acd912189695d3426ba7d58ef53c41a32e

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_306f41cc7115467b5eeea09f3e77e503_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260718-kcazpsg121
SHA256 9978e78aaf4866456cdf0d38eca411acd912189695d3426ba7d58ef53c41a32e
MD5 306f41cc7115467b5eeea09f3e77e503
SHA1 8af51ad586977e0fea0f4b35fdc1ad626959cd81
SHA512 195490120269dc52eb29fbbb35996842f6f6375a4b22e718a11d00018783d0d4613884ea1199f7c91d99ee5bdb34881482aff66a3106fc25e079d9540801251f
SSDEEP 98304:p0nAAYEpNhW9OU/jIEeQfoR/IuOFVjUu5t:uNk9FIF0wuf
TLSH
T14AF59E11F6C6C4B1F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2208	original_temp.exe
4232	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_306f41cc7115467b5eeea09f3e77e503_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4232	original_temp.exe
4232	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2208	4996	2026-07-18_306f41cc7115467b5eeea09f3e77e503_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 2208 wrote to memory of 4232	2208	original_temp.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-18_306f41cc7115467b5eeea09f3e77e503_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_306f41cc7115467b5eeea09f3e77e503_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\jds240745796.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240745796.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 902d278f7cda4b0d294c1ace9ca1748d00e7ea2ce6a7f5134e834e3b97192135
MD5 f41cc9c1ac9801b799ffafb82b169446
SHA1 2a6e65369d1e0fcf80b455069541e46a0fc0cabe
SHA512 eb5de7218445ba0ac64cc6b5318a827991ca2f307ace21a831ecc7024b15d3ca0b1b174306c5b1a978bbe52634bc57a333cbeb7935d0873a975241ab430ae6cb
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+wqSnMYenGJiKEbXWtG:y6F0eMpAAYEhpuhw1MPnRWt4/
TLSH
T1E4759E74E783D4F1E92300F1444BE7BA69349E1944318C7BEBC8EF15BAB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7B8F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7B8F.tmp
Size 1.1MB
SHA256 9b9aedd23c92d8db17905a20486484f34339794e4dd9bde5925458b5c9500b3a
MD5 fc6cc3a96c168fe6799c02b699447e89
SHA1 e6741ad0a99814b178502e773ade7d79bd96513f
SHA512 c89840bce37bd2fdd891cc8bda91b2b1b92c539f3ea4b972d6b62001d963e0eb7ff9a8b68eeed51ed365989c8cc59e8c4f30878c5cf4702750dbaa949e881741
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeYA+wqa:V6F0eMpAAYEhpkhw9
TLSH
T11E456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240745796.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 b0542804dca2a2a34597962c94b35a1627111ece80f284f0dad3c007676c6338
MD5 4718741d7fb4ed9f9e2b34250c99e88d
SHA1 3d2132351ca3aa1fa52f648552842ae74e297fab
SHA512 fde284c7ab18ee4e0df22c15f8201bc006b75922e25e684cef76ff06b188fba8732c5bfd2ca542282527d4fcde4d4094e2b0ea65800f00b626dc8240bbae56f7
SSDEEP 3072:PgJjgogH90b+Ux0u8Kj1nXJYN3S4yLtSScNfXTieMXBDZUUW:p7uXI
TLSH
T1C8F320C6852F44FA34138B97C3795C7486A2365E879E491873CFD6EE66448038E2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 6c76539e14cc9fdcb39728f931f6931064199b1c0f4601d6646ef67fc1d29978
MD5 b1b9e611b78e559f73ec1f7ae74264fc
SHA1 f81f24c34b21143e1e409a8e08a98872f6e8e4f6
SHA512 52029e7f15a97656d639f0a5fb74f0f6b0fd1249ef7ddf865dec90ebf28858c4f7e8915d3826447161dc81b211fb974fcdd91348899a735a13a44210225b3b6b
SSDEEP 3072:PgJjgogH90b+Ux0u8Kj1nXJYN3S4yLtSScNfXTieMXBDZUUs:p7uX6
TLSH
T153F320C6852F44FA34138B97C3795C7486A2365E879E491873CFD6EE66448038E2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 f0fdba3df357e3e81f5886f81f386acb031f6f0580f02352569f51f3d9b0014c
MD5 6449f6e587c306813e3e691d8daee9a8
SHA1 20e6388ecd0c73ead4e19f587fab969ef3818a7b
SHA512 a778c1d4bcaf6cfd7e3a0877084662d51a52edbfad89795a2e276e69b78b9cd19ebe9efd5ac5f5e33cb48541c294329ff4696276f156e522bc7d4fd08807a7ca
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBYA+wzX:G6F0eMpAAYEhpNhwj
TLSH
T1EA456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 dd00cf733f806e4909227d785ff2e0469138c458cb3822313b533f34ef138a1f
MD5 0f96e1aacf81bfa63dbebad4d66852a9
SHA1 01c82b7836139d72cf797085b5f7fb51348a5be5
SHA512 70fee3d45fd49f6e5d3cb93ada42252cbe7ad2ed05f05d33c49d4a9a339154a8655e2e135b257af047ec4a84022aaa4be429c02959a9939b7f612c97958b1d69
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdYA+waB:26F0eMpAAYEhp1hwG
TLSH
T112456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 fe23469801e359c030cf9932595e779247b2d667d04d13b5105459158e6edf9d
MD5 790f1cc6a5f04d9da22951eb7cf19c78
SHA1 a469b60e8bc05f3d7fe03e9b1a56c2b4ad6f555f
SHA512 b1dedb65db460db0c60e5c6182ce33b7d69c0e09b78c8ee6b7ca481f9730aeb0dd8deb34f66d13ffa8b45a42c9702ec07ccb96791a8ab583172dd25f5cea57de
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjYA+wkD:G6F0eMpAAYEhpPhwK
TLSH
T1CF456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4996-266-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads