ffe017ab93a9e6e7051039b5aa45994c52c4837c172beec52d4408e968bd3529

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260719-3htm4sax5z
SHA256 ffe017ab93a9e6e7051039b5aa45994c52c4837c172beec52d4408e968bd3529
MD5 156b5e55b3e1b473afabe035b0e0f8fb
SHA1 25b31e43cd81146e020bc9063b5fa4d6337320ba
SHA512 badd42b70b1468e35e04b10c20f547b902a9fb92ffd2cbe2051d8ddef7bec8e096f08a81910c8917b558c04b1482fdd1112d3ce06b180e9a05cbc24ba1ad99eb
SSDEEP 98304:DVrwvJpGaysOCWisBGNv3Zum9JwnWNa14jrWF/IKOJ:D+WiWevppJNa1CGQKOJ
TLSH
T13B161221F47190B3F2EA2871F2B79AFACF2D9525232CDCCF6B9C90E456550D126F1A42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 21 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4812	cmd.exe
4	4812	cmd.exe
7	4812	cmd.exe
8	4812	cmd.exe
9	4812	cmd.exe
10	4812	cmd.exe
12	4812	cmd.exe
13	4812	cmd.exe
14	4812	cmd.exe
15	4812	cmd.exe
16	4812	cmd.exe
17	4812	cmd.exe
18	4812	cmd.exe
21	4812	cmd.exe
22	4812	cmd.exe
23	4812	cmd.exe
25	4812	cmd.exe
26	4812	cmd.exe
27	4812	cmd.exe
29	4812	cmd.exe
30	4812	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\haDfHHaXc.exe	2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2892	haDfHHaXc.exe
3228	haDfHHaXc.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
22	4812	cmd.exe
22	4812	cmd.exe
14	4812	cmd.exe
14	4812	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	haDfHHaXc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	haDfHHaXc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
3228	haDfHHaXc.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3340	3288	2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	88
PID 3340 wrote to memory of 2892	3340	2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 2892 wrote to memory of 3228	2892	haDfHHaXc.exe	92
PID 3228 wrote to memory of 4812	3228	haDfHHaXc.exe	93
PID 3228 wrote to memory of 4812	3228	haDfHHaXc.exe	93
PID 3228 wrote to memory of 4812	3228	haDfHHaXc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\haDfHHaXc.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\haDfHHaXc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\haDfHHaXc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\haDfHHaXc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_156b5e55b3e1b473afabe035b0e0f8fb_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

haDfHHaXc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\haDfHHaXc.exe
Size 3.4MB
SHA256 7cd7bf3a348ddc03ca93d6e3157fc0df3b30cd11bbef63f5182e3a5d1c64c0ef
MD5 d360d7d0b1d03d1923efac200d071cad
SHA1 5854956312a6ca35c65be67bfab1eed8ac55792f
SHA512 9ae30f1d768d24293a7bc0f1d7ff53389eadb5d475a59cc4611f73f0500ee7b2f88f363f08d2d0d272983a788dda2a2ca02480c8fc8f429448965eb00084d087
SSDEEP 49152:X5pUlaVjPtFXrx7wtklbk8wUC3qz8kdQg6Oig6WvynNRCvdWRHnEDA8JiC71v:8oVjPLXrx7okleUC6jXiGvIpRkDBiCR
TLSH
T15BF523914792E3F6EBF058A2B7C97D2B476B467C663C235380DAC2236E61185CC6D6CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2892-19-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2892-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3228-26-0x0000000002B70000-0x0000000002C0E000-memory.dmp

Download

memory/3228-23-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/3228-21-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/3228-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3228-18-0x0000000002B70000-0x0000000002C0E000-memory.dmp

Download

memory/3228-20-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/3288-2-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/3288-0-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/3340-1-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/3340-16-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/3340-15-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/4812-24-0x0000000001670000-0x0000000001709000-memory.dmp

Download

memory/4812-28-0x0000000001BB0000-0x0000000001C4E000-memory.dmp

Download

memory/4812-29-0x0000000001BB0000-0x0000000001C4E000-memory.dmp

Download

memory/4812-30-0x0000000001BB0000-0x0000000001C4E000-memory.dmp

Download

memory/4812-31-0x0000000001670000-0x0000000001709000-memory.dmp

Download