4601744fb52ff0cb5ed60aa7047f9d9c9be5c0f0ba7d559f39c2845e6b5cc3b0

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260720-t86wpagv4j
SHA256 4601744fb52ff0cb5ed60aa7047f9d9c9be5c0f0ba7d559f39c2845e6b5cc3b0
MD5 f1d30fc167e01f06fa7d7ba667e26286
SHA1 7140248e3a9dabceeb814db4feae2c84e3085cb3
SHA512 a6a5074043010e9b8bff19c5374046ccdbf296c58441042ba3a6c14f96a6bbb0bc0e8c1f9b0241d29f98f89ce57476b3611aa270bb4047742ae4340b690e3901
SSDEEP 98304:nVrwvJpGrrZK6BbOfSQySfL3rk6tPH5xM5TtAHIE8:n4KEFH5ieHIp
TLSH
T110161219B941C0F2EDF20235E0AD9BB30F3853623310A1D3B79458BC9A7D4D66B77A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 18 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5220	cmd.exe
9	5220	cmd.exe
10	5220	cmd.exe
13	5220	cmd.exe
14	5220	cmd.exe
17	5220	cmd.exe
21	5220	cmd.exe
22	5220	cmd.exe
23	5220	cmd.exe
25	5220	cmd.exe
26	5220	cmd.exe
27	5220	cmd.exe
28	5220	cmd.exe
30	5220	cmd.exe
32	5220	cmd.exe
33	5220	cmd.exe
34	5220	cmd.exe
35	5220	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APUyOb9.exe	2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
1296	APUyOb9.exe
5768	APUyOb9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APUyOb9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APUyOb9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5768	APUyOb9.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe
5220	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1292	4828	2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 1292 wrote to memory of 1296	1292	2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 1296 wrote to memory of 5768	1296	APUyOb9.exe	92
PID 5768 wrote to memory of 5220	5768	APUyOb9.exe	93
PID 5768 wrote to memory of 5220	5768	APUyOb9.exe	93
PID 5768 wrote to memory of 5220	5768	APUyOb9.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APUyOb9.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APUyOb9.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APUyOb9.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APUyOb9.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-20_f1d30fc167e01f06fa7d7ba667e26286_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5768
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

APUyOb9.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APUyOb9.exe
Size 3.4MB
SHA256 9cad69f3ad9564c8ec16d21e7c7af0694263845c8faac596f100e167ad42a0d0
MD5 0fd0e3152b046a904248360cef3fe0c4
SHA1 fedf00238ddd1ceb4463709e1cc20521729b7ec6
SHA512 c22448c4b3de6592df823665f0491f022aa919e1a758f03a12cbe519027f8f82635d6aaed9e4ea13547b33720068a02b16bfb0cefa41fc5fa3d3ee612b526f33
SSDEEP 98304:ak4NG0Htjb7WLQ77JViNRCIPF3qwu3ljqg:al0km07JVY4m01e
TLSH
T1BEF522E27F1DD58ED2A9A330AA40924CF0F68C2D0D38D6A5D1CF18CBD59488E76F6749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-13-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/1292-1-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/1292-15-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/1296-22-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1296-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4828-10-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/4828-0-0x0000000000400000-0x00000000007FDADF-memory.dmp

Download

memory/5220-36-0x0000000002130000-0x00000000021C9000-memory.dmp

Download

memory/5220-35-0x0000000002540000-0x00000000025DE000-memory.dmp

Download

memory/5220-34-0x0000000002540000-0x00000000025DE000-memory.dmp

Download

memory/5220-33-0x0000000002540000-0x00000000025DE000-memory.dmp

Download

memory/5220-29-0x0000000002130000-0x00000000021C9000-memory.dmp

Download

memory/5768-25-0x0000000077008000-0x0000000077009000-memory.dmp

Download

memory/5768-23-0x0000000077008000-0x0000000077009000-memory.dmp

Download

memory/5768-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5768-26-0x0000000077008000-0x0000000077009000-memory.dmp

Download

memory/5768-28-0x0000000077008000-0x0000000077009000-memory.dmp

Download

memory/5768-27-0x00000000026E0000-0x000000000277E000-memory.dmp

Download

memory/5768-20-0x0000000077008000-0x0000000077009000-memory.dmp

Download

memory/5768-31-0x00000000026E0000-0x000000000277E000-memory.dmp

Download

memory/5768-21-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/5768-19-0x0000000077008000-0x0000000077009000-memory.dmp

Download

memory/5768-18-0x00000000026E0000-0x000000000277E000-memory.dmp

Download

memory/5768-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download