20e88fdb19d47de69d0010a78c8d31db5bad0d3f9e17ddc12d2bd4c478972304

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_7d495cf281905123c1ef91fdc31af7bc_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.8MB
Sample260727-hdnabaam91
SHA256 20e88fdb19d47de69d0010a78c8d31db5bad0d3f9e17ddc12d2bd4c478972304
MD5 7d495cf281905123c1ef91fdc31af7bc
SHA1 8e23722e9ffc2fa00ee1b7e13d17c6ac47496891
SHA512 0f2340b0c8b54591104ebdb0ab7813b8da1dfd31e0cc94e6115bc7ce1dfb8aa47c3adc912a9b6cd15c9723cd39a274a228f946c88ce0fe04334552d3b4141c4d
SSDEEP 49152:joa1taC070U+myNrZdJbkNzKO5OCFIlCRLRw:joa1taC0ADkN2oOfb
TLSH
T12DD5CF0173F81265F0F71F7769B4A67E493BFC71DA22C25F1188865E0EA2B806D65B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5780	E606.tmp

Executes dropped EXE 1 IoCs

pid	Process
5780	E606.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_7d495cf281905123c1ef91fdc31af7bc_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E606.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5780	4300	2026-07-27_7d495cf281905123c1ef91fdc31af7bc_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d495cf281905123c1ef91fdc31af7bc_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d495cf281905123c1ef91fdc31af7bc_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\E606.tmp
  "C:\Users\Admin\AppData\Local\Temp\E606.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_7d495cf281905123c1ef91fdc31af7bc_amadey_elex_glassworm_njrat_smoke-loader.exe 3178D289324B1C7ABCC511915C4C2B3E6B83B159875B68B8C9B2DC522C5E1AB9BBFD5683DE7A725A952706AD3F550409482A9A86785472D24BD1845224E768F3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E606.tmp

Path C:\Users\Admin\AppData\Local\Temp\E606.tmp
Size 2.8MB
SHA256 9e331083f545b9b8e737cfea5ed9973b190ac6385457b13de3c2983209bd78d4
MD5 e5be968013ddb8009ee80115b0664c5a
SHA1 48934cc3aa1d73e6f055d019f13dd6a5995a87d3
SHA512 59107df17a503364bfe57ec79ba38811cb32f3cb17d02e8842229b977e6f2d02285dcffd7c513a72f00a7f16f7f07de1ba503a670e6b4138af5a64daf353ec86
SSDEEP 49152:joa1taC070UGTIc6pFfayOPV9J1A547AtO9kIlCRLRw:joa1taC0DpFkjJ1AoAY7b
TLSH
T12FD5CF0173F81165F0FB1F7369B4A67E4977FC71DA22C25F1188865E0EA2B806DA5B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-0-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4300-6-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/5780-8-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/5780-10-0x0000000000400000-0x0000000000697000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads