0b190815d944920ae148d95fc52ce1e77e2eab2d49275da21cb01ce0342c5dd6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a9c6a1c9f19f37c32bf51824ff40ee60_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 3.9MB
Sample260718-mpqa9sbz3x
SHA256 0b190815d944920ae148d95fc52ce1e77e2eab2d49275da21cb01ce0342c5dd6
MD5 a9c6a1c9f19f37c32bf51824ff40ee60
SHA1 183421b6c14ca747a081c0e7a4a051ae2ef86514
SHA512 7f1703d5b7ceac1c1d9530c332f334d3a0638a0df1cd70f8feca9df74252c7a00bdc2ea813d1408b456e2342ecf5057bdaddfd14364e00dd016c4a52d1b3cf90
SSDEEP 49152:Moa1taC070UHu0mA7DXozdvgJig/VmgbQIzZMPXpB91rHpn:Moa1taC0xuID4xumnLrHp
TLSH
T1AF169C57EB814AE9E38D0436EF548150972AF26997FF1261746C020CEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3208	FE50.tmp

Executes dropped EXE 1 IoCs

pid	Process
3208	FE50.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a9c6a1c9f19f37c32bf51824ff40ee60_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FE50.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3208	4832	2026-07-18_a9c6a1c9f19f37c32bf51824ff40ee60_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a9c6a1c9f19f37c32bf51824ff40ee60_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a9c6a1c9f19f37c32bf51824ff40ee60_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\FE50.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE50.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-18_a9c6a1c9f19f37c32bf51824ff40ee60_amadey_elex_glassworm_njrat_smoke-loader.exe 4B1E76814491B6AD0FA5A47F3685CAF41C2193AE1C841FF16BCE10AD60CFC26FBE900F2D11C337185A5DF6ABA462E3EFC07AA22C09694984FD47393D1129446D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FE50.tmp

Path C:\Users\Admin\AppData\Local\Temp\FE50.tmp
Size 3.9MB
SHA256 ab95fdb1b3f04d168f57e83758119fcf59ada49e7968778c1b3e2ed7da25ce85
MD5 4cca96b645c5f38ba34a88c5e68333a0
SHA1 5bc13a56176d6c1c978c17440ecfe55bb3d3adea
SHA512 e0a3e2a484db483fa1ed2d257f3d12c621fac4bb8763caa065268855e97b8e6b43cbae21e1831c66c01f4ebfc85ef634936d22f923fbc6f252e3a9e66b2a6531
SSDEEP 49152:Moa1taC070UVcB/ZeYZlrf8GA4eQRAHClVmgbQIzZMPXpB91rHpn:Moa1taC0I1trTfLeQynLrHp
TLSH
T1C1168B57EB814AD9E38D0836EF548150D72AF26997FF12617468020CEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download