7a1eac3e502330636fd65c2c66628a9e1dc677d59461889c502124f3a204c900

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_a10c4da268cc060a3349bb088117aaec_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.8MB
Sample260727-j2pcysyejd
SHA256 7a1eac3e502330636fd65c2c66628a9e1dc677d59461889c502124f3a204c900
MD5 a10c4da268cc060a3349bb088117aaec
SHA1 5df41e6c0f65fe93c0b646494572fae472716eea
SHA512 842a92bac387268feb7dbe44036311f5172023dc28e2f1afffcdd4fcc818a57ec8027558ab8e9106de5e028783a6bcbba444f053359162e2650f12b31f68977e
SSDEEP 24576:A2oo60HPdt+1CRiY2eOBvcj3u10UY/1WwL/L22xeGDEr1n75IE0AncxBsybdlQ75:Foa1taC070U8TiVvUsoMnqbmEFV
TLSH
T158D58A53E7814AE9E7890436DF148151972AF12DABFB1232385802CDEE47787BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3696	75E2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3696	75E2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_a10c4da268cc060a3349bb088117aaec_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75E2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 3696	1860	2026-07-27_a10c4da268cc060a3349bb088117aaec_amadey_elex_glassworm_njrat_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-27_a10c4da268cc060a3349bb088117aaec_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_a10c4da268cc060a3349bb088117aaec_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\75E2.tmp
  "C:\Users\Admin\AppData\Local\Temp\75E2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_a10c4da268cc060a3349bb088117aaec_amadey_elex_glassworm_njrat_smoke-loader.exe 0B3C9D8BE1566BE6CC1C1D8C1E8C35DF3366F3EF99D99791B4E6920AC4A87E9AC151383F371E4EAEAE9C2EEAA4FE4AD892F1FA4A75A545F0C2B141F0429ABF4A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\75E2.tmp
Size 2.8MB
SHA256 47c5084979c12069e47cc60e51532864e904965835b626e6b5504b3ab6a9c708
MD5 ef07a4f6e0b0055b1df08350c9035eda
SHA1 42be988359032cdc0cb8426643485694c51418ba
SHA512 16f382df2af86aeb48eebcedbed5b0fe9e48e50ea99958ecc5fe347db0ff1b0088959acfb0600fda1b454535cb1586e2db32db5815e95709f5bf00fd07625e6e
SSDEEP 49152:Foa1taC070UiauC/EWNi08cXy5xWeYlJcV:Foa1taC0kCsWw0/XqYrl
TLSH
T16BD58A53E7818AE9E7890436DF108151972AF12DA7FB5632785C02CDEE47387BF61A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download