Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 17:38
General
- Target 2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 6.2MB
- Sample260720-v778ssbw5v
- SHA256 77c3a231286d1f1960c343d6452ad4b94046a5a5e78268cc293b33ff6ec41b48
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 14 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Detects Pyinstaller 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.~01C:\Users\Admin\AppData\Local\Temp\2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.~012⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.~01C:\Users\Admin\AppData\Local\Temp\2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.~013⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-07-20_60d0bfe0cdea160b0e7cd0c954b0e305_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.~01
VCRUNTIME140.dll
_bz2.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
downloader.exe.manifest
libcrypto-1_1.dll
libssl-1_1.dll
python37.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
SYSLIB32.DLL
memory/2480-117-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-144-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-95-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-99-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-104-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-109-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-130-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-0-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-9-0x0000000010000000-0x0000000010008000-memory.dmp
memory/2480-134-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-138-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-140-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-125-0x0000000000400000-0x0000000000437BE6-memory.dmp
memory/2480-149-0x0000000000400000-0x0000000000437BE6-memory.dmp