834733672ef28ac78679aabee73054f47e84f7a6073e264b72ca4a851d5ef26b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.6MB
Sample260720-tdj4faft7j
SHA256 834733672ef28ac78679aabee73054f47e84f7a6073e264b72ca4a851d5ef26b
MD5 5e435ef0bbfd45ae45f472c799f9112f
SHA1 1ed212a6d05afc1a492e4173b4f81bee5965bb2f
SHA512 258d5a035a25deb152f7d7e89f6bd7ac7b4ec1ed3b6f7f51fc0ef3f70d7b6b8a5087a158f0aaa8f35dcf5c223a6abc5c9e06b6526915021b2651240f72fb5d05
SSDEEP 49152:+oa1taC070Up/eBXoI+M/w7lUy4Idzpk6:+oa1taC0aoIl/wZldzpk
TLSH
T1E6D5DF57E7918AE8D69D05366B208240962EF522AACF1712399C130DCF57787BF26F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1656	1827.tmp

Executes dropped EXE 1 IoCs

pid	Process
1656	1827.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1827.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 1656	4388	2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\1827.tmp
  "C:\Users\Admin\AppData\Local\Temp\1827.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe 89EA692C725B025DEA460DE6A98BBE6D0982769C33E9A7A54BC2C02AD02A60DAE0F80BAAB08900F7D61BD0967CE1226D45A23FF1C379B215CBFB299D3E21D33C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1827.tmp

Path C:\Users\Admin\AppData\Local\Temp\1827.tmp
Size 2.6MB
SHA256 75e1b9fdc0d6b4d908e62028616066aad585f44fe9c15d96749a7ed15fd9fc4f
MD5 1fc0469f96517ef073714cf147961788
SHA1 765de781fd2d00b59c9fda57c634fd2fdd7447df
SHA512 71b91bd6b1e8c2630af425b37503277444ef90c112797322adf80a2ff1d3428006b6ff9a9565785f71b26c93fb3640f0edb93d394cadd72c7b5ace72502196ae
SSDEEP 49152:+oa1taC070U0vPl1qg7FosfCFLssDr2zqPoocN00lSwNT7:+oa1taC0OvrPZosfSLss3PPo00lj
TLSH
T1E0D5DF57E7918AE9D65D09366B208240962EF5226BCF1712799C020DCF877C7BF22E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download