f3595aede8602a9d028846a725cd9cab3ce87087127f17f710a56bea02a2fb71

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260722-3ce8jadd67
SHA256 f3595aede8602a9d028846a725cd9cab3ce87087127f17f710a56bea02a2fb71
MD5 bce7f55ecf795441b893f33a93a4174e
SHA1 b39a8dce218263692f43b6e3a67a997d6dce7f27
SHA512 83b47a49663b14a24bbd9368afddbddbb4de78b7d3d20ade90f3ba783bfabcbeaca862a4aae7e2ca2e528e6807ef540c189f849dbcc60cbde166abf3da487f71
SSDEEP 98304:eVrwvJpGXPVRhYiq1wQKjsVwrXEzYRfpNzfRSYo:e1KqQKS+XT7zQ
TLSH
T1D016122178039CA2EDB12D786076B6B72F287D12233192F7E7D60EF25A572D1E235606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery suricata

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	4136	cmd.exe
11	4136	cmd.exe
12	4136	cmd.exe
13	4136	cmd.exe
16	4136	cmd.exe
17	4136	cmd.exe
18	4136	cmd.exe
19	4136	cmd.exe
20	4136	cmd.exe
24	4136	cmd.exe
25	4136	cmd.exe
27	4136	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b9fVzWy.exe	2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
1996	7b9fVzWy.exe
3684	7b9fVzWy.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
27	4136	cmd.exe
27	4136	cmd.exe
19	4136	cmd.exe
19	4136	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b9fVzWy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b9fVzWy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
3684	7b9fVzWy.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe
4136	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 6072	1132	2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 6072 wrote to memory of 1996	6072	2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 1996 wrote to memory of 3684	1996	7b9fVzWy.exe	92
PID 3684 wrote to memory of 4136	3684	7b9fVzWy.exe	93
PID 3684 wrote to memory of 4136	3684	7b9fVzWy.exe	93
PID 3684 wrote to memory of 4136	3684	7b9fVzWy.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b9fVzWy.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b9fVzWy.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b9fVzWy.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b9fVzWy.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-22_bce7f55ecf795441b893f33a93a4174e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7b9fVzWy.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b9fVzWy.exe
Size 3.4MB
SHA256 6d5d708203f78215519e91bf788210127901924faf8e6c7e0f803f22fc175ccb
MD5 efce79590314e57c453e60f5741f9fef
SHA1 6a0819106d300d2bc874d72af6cbc20799bddadf
SHA512 732e538d55fc612b07c11a29b901572e822787a5d4d7f929127e42401f9b5d3e96b3b3559def4d959780452dfe5d558790830e667c5a3187c612b7bd05a5c27f
SSDEEP 49152:0IBamDeG0k9N8tiIwB4JGy3SlFvnA62Om/yNSorjjYgleSIisOrgBl0cXfb36nD0:0FmDAN+A62OFNVrjjlvTL+PbQ
TLSH
T157F523B0CD0CDF4CED5E36620578F5E5A89F08F9182C7E886C45B0868CBADAE3665F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-0-0x0000000000400000-0x00000000007FD6F9-memory.dmp

Download

memory/1132-3-0x0000000000400000-0x00000000007FD6F9-memory.dmp

Download

memory/1996-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/1996-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3684-22-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download

memory/3684-27-0x0000000002B50000-0x0000000002BEE000-memory.dmp

Download

memory/3684-18-0x0000000002B50000-0x0000000002BEE000-memory.dmp

Download

memory/3684-19-0x0000000077928000-0x0000000077929000-memory.dmp

Download

memory/3684-24-0x0000000077928000-0x0000000077929000-memory.dmp

Download

memory/3684-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3684-21-0x0000000077928000-0x0000000077929000-memory.dmp

Download

memory/4136-25-0x0000000001C30000-0x0000000001CC9000-memory.dmp

Download

memory/4136-29-0x0000000002060000-0x00000000020FE000-memory.dmp

Download

memory/4136-30-0x0000000002060000-0x00000000020FE000-memory.dmp

Download

memory/4136-31-0x0000000002060000-0x00000000020FE000-memory.dmp

Download

memory/4136-32-0x0000000001C30000-0x0000000001CC9000-memory.dmp

Download

memory/4136-35-0x0000000002060000-0x00000000020FE000-memory.dmp

Download

memory/6072-1-0x0000000002BB0000-0x0000000002C4E000-memory.dmp

Download

memory/6072-11-0x0000000000400000-0x00000000007FD6F9-memory.dmp

Download

memory/6072-16-0x0000000002BB0000-0x0000000002C4E000-memory.dmp

Download