834733672ef28ac78679aabee73054f47e84f7a6073e264b72ca4a851d5ef26b

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.6MB
Sample260720-tdj4faft7j
SHA256 834733672ef28ac78679aabee73054f47e84f7a6073e264b72ca4a851d5ef26b
MD5 5e435ef0bbfd45ae45f472c799f9112f
SHA1 1ed212a6d05afc1a492e4173b4f81bee5965bb2f
SHA512 258d5a035a25deb152f7d7e89f6bd7ac7b4ec1ed3b6f7f51fc0ef3f70d7b6b8a5087a158f0aaa8f35dcf5c223a6abc5c9e06b6526915021b2651240f72fb5d05
SSDEEP 49152:+oa1taC070Up/eBXoI+M/w7lUy4Idzpk6:+oa1taC0aoIl/wZldzpk
TLSH
T1E6D5DF57E7918AE8D69D05366B208240962EF522AACF1712399C130DCF57787BF26F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1232	1F36.tmp

Executes dropped EXE 1 IoCs

pid	Process
1232	1F36.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F36.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 1232	5256	2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Users\Admin\AppData\Local\Temp\1F36.tmp
  "C:\Users\Admin\AppData\Local\Temp\1F36.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_5e435ef0bbfd45ae45f472c799f9112f_amadey_elex_glassworm_njrat_smoke-loader.exe 275DDAE4C0074E634053B76F2BFE5355AC73C7330DD3A9EFD6EAB4439683372C9DC48ECF6D006EE5F31F129CA25D28EAF9375CF67401852F92B0E3A8609DC1E8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F36.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F36.tmp
Size 2.6MB
SHA256 3d632498b5e9eaf20b9e50eedfd8df356da0ca8361fc114ac8c30b6595253b0d
MD5 9e84fede4df2f9c53124ec87984bd85d
SHA1 292665b5271a3de7fb8ad2c5c6f18c085d0dc34b
SHA512 f06b851b2c7822fffebf20d28466f8c359d1cd56aa398401669f5b2499441d34739d75b508335a0fd54fd982e63cc73c52faf7325f781c66d863db6c81d1ee83
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10U0CuEpRBfvTDt16wavPzu+x6qBrbCUzLPpap2:+oa1taC070U71/BnFSPzu+zIUzLPUS
TLSH
T19DD5DF67E7818AE8D69D45365B248240962EF522AACF5722799C030DCF43787BF31E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download