fc7ac857d30360974e83da08af19c3bfb1def835786719cc4b690f40f4c0a1cb

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260719-3qf2zsbs8x
SHA256 fc7ac857d30360974e83da08af19c3bfb1def835786719cc4b690f40f4c0a1cb
MD5 09ff0c29d4a6b1eb1a1c1c5aa00d5c0d
SHA1 6f65c739e647933b9bd9936e21608fd7c42cf68c
SHA512 521f6672d9f3411c1f8c5ef91e18a88e78e15fe9ea405d40b85ff8590b37efcd87f4540b883a351ef20316e2da599231626e342dd824c9b1fb13b469e5f13f87
SSDEEP 98304:26RubJAvI2gunLQDRxKQBqBTrQr9M3/mVrwvJpG:22nA2eDvkBTrQM+
TLSH
T147161231BE00C676F0E62472A1FDC7BF792E632957A8C0C752911DA4B7A44C27A35BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 19 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4252	cmd.exe
10	4252	cmd.exe
11	4252	cmd.exe
12	4252	cmd.exe
13	4252	cmd.exe
14	4252	cmd.exe
18	4252	cmd.exe
19	4252	cmd.exe
20	4252	cmd.exe
22	4252	cmd.exe
23	4252	cmd.exe
25	4252	cmd.exe
26	4252	cmd.exe
27	4252	cmd.exe
28	4252	cmd.exe
31	4252	cmd.exe
32	4252	cmd.exe
36	4252	cmd.exe
37	4252	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LQuBtEK9omd1A.exe	2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
5800	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
36	4252	cmd.exe
36	4252	cmd.exe
28	4252	cmd.exe
28	4252	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LQuBtEK9omd1A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LQuBtEK9omd1A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
5000	LQuBtEK9omd1A.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe
4252	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 5856	1124	2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	87
PID 5856 wrote to memory of 5800	5856	2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 5800 wrote to memory of 5000	5800	LQuBtEK9omd1A.exe	91
PID 5000 wrote to memory of 4252	5000	LQuBtEK9omd1A.exe	92
PID 5000 wrote to memory of 4252	5000	LQuBtEK9omd1A.exe	92
PID 5000 wrote to memory of 4252	5000	LQuBtEK9omd1A.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LQuBtEK9omd1A.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LQuBtEK9omd1A.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LQuBtEK9omd1A.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LQuBtEK9omd1A.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_09ff0c29d4a6b1eb1a1c1c5aa00d5c0d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LQuBtEK9omd1A.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LQuBtEK9omd1A.exe
Size 3.4MB
SHA256 e764a42098cabc8884eb629660f25b020c50c86c922a5a112715ce289dcb9110
MD5 5de47536b8b017ef30c22a136e94e0f8
SHA1 c3e4dec338960f967056204989f704568d33ae7e
SHA512 740f05ab539472c6a235e76c1f0fbde174075ef987d1b91be2fe0d87d757d0650e6b872224b813719e0ccbb4037e4b25c59c982c59fd865f8978bb6f0a9f9adb
SSDEEP 98304:Zt51FuCPpAkiJixgAuSSVO/s1gnezHwArcWsxoLWi:Zt5HuoB8ixgA//TezHwKsCB
TLSH
T178F523E8469DC338D2766431E1E48D7B247B2C92CCA651D33FD7F864224B673E21E689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1124-10-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4252-30-0x0000000001F60000-0x0000000001FF9000-memory.dmp

Download

memory/4252-29-0x0000000002280000-0x000000000231E000-memory.dmp

Download

memory/4252-28-0x0000000002280000-0x000000000231E000-memory.dmp

Download

memory/4252-27-0x0000000002280000-0x000000000231E000-memory.dmp

Download

memory/4252-23-0x0000000001F60000-0x0000000001FF9000-memory.dmp

Download

memory/5000-18-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5000-21-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/5000-20-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5000-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5000-17-0x00000000026B0000-0x000000000274E000-memory.dmp

Download

memory/5000-25-0x00000000026B0000-0x000000000274E000-memory.dmp

Download

memory/5800-19-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5800-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5856-15-0x0000000002BB0000-0x0000000002C4E000-memory.dmp

Download

memory/5856-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5856-1-0x0000000002BB0000-0x0000000002C4E000-memory.dmp

Download