77e179fb8d18bf0c0f86700b48690b23900f8a8596f70fc0ba965c389360c8f1

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_9158e0a786e2f455ff602b8a0c738bff_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.8MB
Sample260721-sdp41sycra
SHA256 77e179fb8d18bf0c0f86700b48690b23900f8a8596f70fc0ba965c389360c8f1
MD5 9158e0a786e2f455ff602b8a0c738bff
SHA1 68a409473379236b341e692043d551d76eb64feb
SHA512 4906bf46ecf6d07b800f8efce40385800b3d766308260e720c87b4d56f69fe3c1e57c81c405e4be0f7bf1d0acacf1ea42e96b94ca80af1f059971684d5b66cf1
SSDEEP 49152:yoa1taC070Ur+hSoDxTUJqngQUXRezJG2VkVV:yoa1taC01gxiZQKRezY6
TLSH
T143D56953E7814AE9E78D0476DF148150972AF629A7FF62213858120DEE4338BBF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4832	812C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4832	812C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_9158e0a786e2f455ff602b8a0c738bff_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	812C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 4832	6092	2026-07-21_9158e0a786e2f455ff602b8a0c738bff_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_9158e0a786e2f455ff602b8a0c738bff_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9158e0a786e2f455ff602b8a0c738bff_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Users\Admin\AppData\Local\Temp\812C.tmp
  "C:\Users\Admin\AppData\Local\Temp\812C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_9158e0a786e2f455ff602b8a0c738bff_amadey_elex_glassworm_njrat_smoke-loader.exe 5FF2B6F153C083B179438B33F16F1637B3A83141D3C9CA07584A719BF29A6DE9B7F1FEE50F0495143C11E689A531337E935710EFE016DB5B2A39F26F9FC4D678
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

812C.tmp

Path C:\Users\Admin\AppData\Local\Temp\812C.tmp
Size 2.8MB
SHA256 69beb7b2e5b2a8c8c98e74d3b173574225005f317098ba440f7a69e986d9e80e
MD5 5b33a2cc16d7436ab21c91b89248840b
SHA1 92598555166ac533a153254388925473800ec012
SHA512 82dde4241078b37ed8d56b9c2e0a8b49d4421c4690085fef0a985796bfc569dcf7293030291844eabdec9f4d3624d0421105a222f9557f32292cc266961eb9e0
SSDEEP 49152:yoa1taC070UNz5HGH9wif+odBpBh+3G5oTr+korV:yoa1taC0PSiif5/jEG5cr+ko
TLSH
T1B5D57A53E7818AD9E78D0476DF148150972AF629A7FF62213858120DEE4378BBF61E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download