1854294b89f9204eb36d84d185fe12a258b9b82976b41172a621d41f657be813

Analysis

max time kernel
148s
max time network
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260720-be4v5adv41
SHA256 1854294b89f9204eb36d84d185fe12a258b9b82976b41172a621d41f657be813
MD5 88f28c0990a7f91275cd10e44a4b316e
SHA1 77a90bdcf783b22b765292492e1308c3177a5330
SHA512 a53877089eaba6b0c0c760394598b194703bc917314fec5f9cf4dcb0c2f9a4cdf045231e4a68a9ff9d0d370efaab1244b38c0cf5c705a8574e0828de6e03476f
SSDEEP 49152:edVIPOTUKyQ21WyD0/z7Vvc01kF0OXFz9wvJpGVb:aUKyQ21Wr7Zv71wVrwvJpG
TLSH
T11716BD2BB483D42BE9D21E3782644677682C71783FD19CD3779041A9AE678C26A317F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sJxVJ2N9yPFkA.exe	2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
1664	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	1084	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sJxVJ2N9yPFkA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sJxVJ2N9yPFkA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
2808	sJxVJ2N9yPFkA.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe
1084	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1008	2544	2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	88
PID 1008 wrote to memory of 1664	1008	2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 1664 wrote to memory of 2808	1664	sJxVJ2N9yPFkA.exe	92
PID 2808 wrote to memory of 1084	2808	sJxVJ2N9yPFkA.exe	93
PID 2808 wrote to memory of 1084	2808	sJxVJ2N9yPFkA.exe	93
PID 2808 wrote to memory of 1084	2808	sJxVJ2N9yPFkA.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sJxVJ2N9yPFkA.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sJxVJ2N9yPFkA.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sJxVJ2N9yPFkA.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sJxVJ2N9yPFkA.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_88f28c0990a7f91275cd10e44a4b316e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 796
        6⤵
        Program crash
        
        PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1084 -ip 1084
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sJxVJ2N9yPFkA.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sJxVJ2N9yPFkA.exe
Size 3.4MB
SHA256 6a0166032146accb319f2b82dd0a075c9c48a1188ff79198535d5a04e361387b
MD5 791483e982cbadf0e75841964db12808
SHA1 6df8cd147e3b2f28f9a9192c342477f2f1058fee
SHA512 26ebc6154a854c7b2bd9385a6afe2f85b74863b7ccea19d83cb61dc94c805dbb06c6fa9f5635b34ca02936fdc9c28e518ed1acb3316ca28c2cf3d5b2a7329533
SSDEEP 49152:qhd8qUubYn06oZ7+vAftDpMtodh+QgMI:qhd8Sk068fppMtodhrI
TLSH
T1F0F5DF8DCD2CF45BF60C6B73AFED849E2B8723AE6705B99D53A1041191BC36923DE910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-1-0x0000000002B60000-0x0000000002BFE000-memory.dmp

Download

memory/1008-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1008-15-0x0000000002B60000-0x0000000002BFE000-memory.dmp

Download

memory/1084-28-0x0000000000D50000-0x0000000000DE9000-memory.dmp

Download

memory/1084-34-0x00000000013E0000-0x000000000147E000-memory.dmp

Download

memory/1084-30-0x00000000013E0000-0x000000000147E000-memory.dmp

Download

memory/1664-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1664-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2544-10-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2544-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2808-27-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/2808-25-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/2808-24-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/2808-23-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/2808-22-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/2808-21-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/2808-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2808-26-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/2808-19-0x0000000077B98000-0x0000000077B99000-memory.dmp

Download

memory/2808-31-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/2808-17-0x0000000002660000-0x00000000026FE000-memory.dmp

Download