0d655319b93e72797a72ef13986e9f2a3f9e82f4b4d1bd97b01ae3383ceb50e3

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260723-v4tk8scb87
SHA256 0d655319b93e72797a72ef13986e9f2a3f9e82f4b4d1bd97b01ae3383ceb50e3
MD5 41862e1d646f47283a21b30a2c978cc1
SHA1 62a448855c0521bbc89556a38242914613f9b465
SHA512 b7f559ee183e03beff39ab63ef193cafcfbd7be1e28a99355bf9a0171895ae19a22450ecc171c00dae64c16e72d13d72d58da08ae33ba8a1686fcce93fb67555
SSDEEP 49152:t0OXFz9wvJpGVbX0HA+aX2HAxxmHyXWqvvaasVGnpBuRal:tVrwvJpGRikX2HAWSXB3BnmQ
TLSH
T15A16AD52BC02A423F19FF335B0776AA2BB2B75211364C0FB528084E559DC7EDBA2DE15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ZfOjfIIHVavu.exe	2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
6272	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	5048	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ZfOjfIIHVavu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ZfOjfIIHVavu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
6320	3ZfOjfIIHVavu.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe
5048	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3948	4420	2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	90
PID 3948 wrote to memory of 6272	3948	2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	92
PID 6272 wrote to memory of 6320	6272	3ZfOjfIIHVavu.exe	93
PID 6320 wrote to memory of 5048	6320	3ZfOjfIIHVavu.exe	94
PID 6320 wrote to memory of 5048	6320	3ZfOjfIIHVavu.exe	94
PID 6320 wrote to memory of 5048	6320	3ZfOjfIIHVavu.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ZfOjfIIHVavu.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ZfOjfIIHVavu.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6272
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ZfOjfIIHVavu.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ZfOjfIIHVavu.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_41862e1d646f47283a21b30a2c978cc1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:6320
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5048
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 732
        6⤵
        Program crash
        
        PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5048 -ip 5048
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ZfOjfIIHVavu.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ZfOjfIIHVavu.exe
Size 3.4MB
SHA256 2ec0d6a8753a4dd011affa116d391772a31e4a27178175e903de102a5a33e990
MD5 1f6a09968dd7b4b9a2b225792a94dadf
SHA1 8e3e1a1e3eba74c5fbbe2f0b38743e7ef1037136
SHA512 44f3322dac5b12dcda54a1bf7a1c4ca06e2fd26a944773024c5a6fabe28c385ba8b35b0f468645c3e51dbfe94a42974dcc7b793d024b7859eb068901f54246f4
SSDEEP 24576:1tavtlG8hvDn+lpn5Mwv8m9VDYCL45vsQ2dJRI2oGQwZ1q7U9gZXdtyl6:AeuvIqwvBVDjsBthwHhEXd0g
TLSH
T12BF5CEBDC6B93608B3F760AFE360D9EBA70374ED97D6202FC88816D0440A99C5D6F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3948-1-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/3948-2-0x0000000002B60000-0x0000000002BFE000-memory.dmp

Download

memory/3948-14-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/3948-16-0x0000000002B60000-0x0000000002BFE000-memory.dmp

Download

memory/4420-11-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/4420-0-0x0000000000400000-0x00000000007FD8AE-memory.dmp

Download

memory/5048-25-0x0000000000810000-0x00000000008A9000-memory.dmp

Download

memory/5048-30-0x0000000001470000-0x000000000150E000-memory.dmp

Download

memory/5048-28-0x0000000001470000-0x000000000150E000-memory.dmp

Download

memory/6272-12-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/6272-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/6320-18-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/6320-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/6320-24-0x0000000077B48000-0x0000000077B49000-memory.dmp

Download

memory/6320-21-0x0000000077B48000-0x0000000077B49000-memory.dmp

Download

memory/6320-27-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/6320-22-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/6320-19-0x0000000077B48000-0x0000000077B49000-memory.dmp

Download