7ae3375ed1ef127f99279881d8293769c0bf3933e75b55402cce2694447113b0

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_8d00ff7bf5262ba9f3cb28298157da31_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 4.1MB
Sample260721-sebb9aydjf
SHA256 7ae3375ed1ef127f99279881d8293769c0bf3933e75b55402cce2694447113b0
MD5 8d00ff7bf5262ba9f3cb28298157da31
SHA1 c0e39154ee9ef6d205bb12c12159704ac31dbaf9
SHA512 29bd67ed95dc8aed16387e1663f754d8fb42a844975a62aaf24f7deff6fbfa4f50015f49b399baaee0311b54fc314473f09d7d9da7e627f5ef80df0bc5d7e9ae
SSDEEP 49152:1vm22OdWOXqrbIyUJVvgWOp2PtIrIwpV1XCbHf8hdwLVT5kUvgJSgHT6ojkxFbx5:pmSWOiIyUjeEKfV1Xfh+VLUjH5oxFbx
TLSH
T17116E053E7818AE8E24D44B66F554241D72EF621AA8F6311399C130DCF8738BAF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3308	208E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	208E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_8d00ff7bf5262ba9f3cb28298157da31_amadey_elex_glassworm_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3308	2832	2026-07-21_8d00ff7bf5262ba9f3cb28298157da31_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_8d00ff7bf5262ba9f3cb28298157da31_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_8d00ff7bf5262ba9f3cb28298157da31_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\208E.tmp
  "C:\Users\Admin\AppData\Local\Temp\208E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_8d00ff7bf5262ba9f3cb28298157da31_amadey_elex_glassworm_njrat_smoke-loader.exe E659F9C5BDBCA02185A41ED0965CFE50E6AE21F67C30CFAE8F15EA2BCA0DD69488A103F615B7BF022303E4BB20821102FBEE519E0B10804C643A6FB88BC3B947
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

208E.tmp

Path C:\Users\Admin\AppData\Local\Temp\208E.tmp
Size 4.1MB
SHA256 b01f159345e16cf412ba46f93b3c54031b0c583cace0d5b58628ef976ca7bb35
MD5 894631365ac4add334970316c8d050e8
SHA1 8b8a8ed20ac59f95f1572ff77e2093c87b823e41
SHA512 517f08642cc9685af56d7dc7ba48e03b303c8ed8f2b7510e2ce3023a495ec5825b8d34b86b1db5f5176aa2008f9a3c35bc5e08fa4fb665ebbe4d55182aa1326f
SSDEEP 98304:pmSWOiIyUHecfLb35pJm3kBNFeVLUjH5oxFbx:pX1e8f5mVUjZEd
TLSH
T1B016E053EB818AE8E64D447A6F554240D72EF621A68F6311399C130DCF8738BAF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download