4e60747275744aaabe7ebfa4e026bbb5f607038c1016acfef83936e55b1391dc

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_591e8d697275f23241fc3168deb980a3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260720-dmsh6sgs21
SHA256 4e60747275744aaabe7ebfa4e026bbb5f607038c1016acfef83936e55b1391dc
MD5 591e8d697275f23241fc3168deb980a3
SHA1 8177d6f6b977b8114f1929b6f7b4844ea1c2572f
SHA512 a65394d27fc59306f824e9c904430417c1d36a0c28fffd709517b8c3855cfea464f9e2c8e753f77c95c90dce3821b7ac15bbb98a87021d03865aca6176ad6dee
SSDEEP 98304:p0nAAYEpfhj9OU/jIEeQfoR/IuOFVjUu5t:uN/9FIF0wuf
TLSH
T1CFF59E11F6C6C4B1F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4780	original_temp.exe
2464	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_591e8d697275f23241fc3168deb980a3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	original_temp.exe
2464	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 4780	5936	2026-07-20_591e8d697275f23241fc3168deb980a3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4780 wrote to memory of 2464	4780	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_591e8d697275f23241fc3168deb980a3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_591e8d697275f23241fc3168deb980a3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\jds240745406.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240745406.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX7A4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7A4A.tmp
Size 1.1MB
SHA256 b5d38d08fdb905f07f1e4609c773710b9ad328107962a7b61c45913cacfd161d
MD5 57e8e3241f2502b4e138e50701eaccb7
SHA1 53e60269002fff17556c69f16b39cb99f0b9123b
SHA512 80a4400982db777348acf3ba1d98eabd8ac656b92e1ab70bf979648010f3e2313f92f6cc02cc5bb6bdfd13ffdd4bb3b9baceba84b35c077c50beb16c8ad37d62
SSDEEP 24576:R7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUYA+wcn:C6F0eMpAAYEhpihwq
TLSH
T13B456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240745406.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 e5620b400605bf6c5bbd9e67f1cd31cb79b1c30f6c6f0fa2ff97596b826f11f7
MD5 9a45671a2e56c4ef18e339d6c8612034
SHA1 3dfa6bae07102ec3cbb3708cf27db17613f58b30
SHA512 f582404461da7eeece871138bb3d2ee5747d4d327e683cecacb5e4bc08a0275ebc0a57c0f30b626e6025da5d99519e5b070d138f9d0c35953d168ea258032234
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MB3:qosS
TLSH
T174F343CA956FC5BA30234E83C77A6C754592355A835E0A2C62CFC2DF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 3a9b2f6d5c9f2e54580d09e5fd115cf7f6c96a9eba02d072b8403e30aeb3c31c
MD5 d59787e41df17f1bfdfa0ee07082df1b
SHA1 b2b4ba8996c73a9190795aec77a40884aff8eb9e
SHA512 c6b0db6274bc895f1d4859c4c216b0e2197b20d0ffad12904077e6dcf795104381dc6938bdce119f01e93bf42c0b99bdf18c7edb52f882a12d1ebb3a69ef1e2b
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBW:qosB
TLSH
T151F353CA956FC5BA30234E83C77A6C754592255A835E0A2C62CFC2DF7645903CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 e3cab28ab05b7a37ba52580f7855e82a3ab029c33c9d3f98340d3d11e0d19c09
MD5 a9ba4ba951528dba3ebf79d59c4d267c
SHA1 84bbb80da97611d994163b1823897e1fc8e31c40
SHA512 d0b5294d60cfff8957978942de5a0b9fa35e174a6ec6faa421e09c166c4e44995d90bdbab1c3028a6bc3dc5e5e808957309378ba68b074f812c9b9bcb62b5414
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzYA+wFE:G6F0eMpAAYEhpfhwO
TLSH
T134456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 7045ab0164fd7c7d0306f0cf6ad2133a4a68ae854b9a056a854ddc2c0b4c0232
MD5 36fcf190f28beac2d2f4f665c838454e
SHA1 bf98734f6cf48280d2f9a0eb61c5d1515bc5fad6
SHA512 80e6a3db307c8e5ac0e0e2f5104125b4a95c51474ef8781c80efd402dbde2651e98df477f5651d1c29df07d54c25d8666dbfdd8d14bfd06466296f73a105eeca
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjYA+wkD:G6F0eMpAAYEhpPhwK
TLSH
T17A456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 62c484a8cb24932443c5397187d772b43af5c1b8fdc0f808ccfe912e6f2b3e77
MD5 1569799579ca7e3d31b9e6ddffa361b1
SHA1 005d37d4225a08b49e94d23e64c57ee96a9794e2
SHA512 7081b202ae50acfa06163e60300a07588028ff2ea8263fed37c82fc500ec940f59b144e37465589d68195718c457219978a762dc5176229e53e432dc8251264e
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODYA+wMW:m6F0eMpAAYEhp7hwL
TLSH
T159456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 1df494ec5330dc1c27ad4ae344b0393df290adbe7b2e5dd87dee6d496a8b0ccc
MD5 2847ebb9001c53f7f127b2be909db79e
SHA1 17e3dd57f0e6afbfc4e48ec4deaa99d99fb91245
SHA512 5acb05fe80c9373942b85393099e80b08517647f4a7a4d42128e8a3b0be79551912d2e893c35602663b7ef2a1f0afa0420ce741aeeacb6477d4839cb7e72cdb7
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcYA+wcf:F6F0eMpAAYEhpihwi
TLSH
T141456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5936-318-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads