512a464cef6364a2e87ef80b1eb3b797c7f3eb571844711410346c89a3f5bbcd

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_f4365bb736fc06ff6d50acb422ee27cd_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 5.4MB
Sample260728-eyr78aap9z
SHA256 512a464cef6364a2e87ef80b1eb3b797c7f3eb571844711410346c89a3f5bbcd
MD5 f4365bb736fc06ff6d50acb422ee27cd
SHA1 a4b6514d942e0fd34bb8ab28719bb2669aef829f
SHA512 a594a0905b84bca7307e007098f9a24de75d080e648d8cee423eb8cf33919b60fbf6b65b6cbfd1227217ccd9f150afa4580ef3c7ab2511def193502eb8a38ade
SSDEEP 98304:pmhd1UryeQSef8y8wCbSz3SVLUjH5oxFbxCVLUjH5oxFbx:plwh86GVUjZEdCVUjZEd
TLSH
T1A546F053EB918AE8E38D08766B554241D72EF621AB9F2351395C120CCF8738B9F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3852	3520.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_f4365bb736fc06ff6d50acb422ee27cd_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3520.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3852	3188	2026-07-28_f4365bb736fc06ff6d50acb422ee27cd_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_f4365bb736fc06ff6d50acb422ee27cd_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_f4365bb736fc06ff6d50acb422ee27cd_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\3520.tmp
  "C:\Users\Admin\AppData\Local\Temp\3520.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_f4365bb736fc06ff6d50acb422ee27cd_amadey_elex_glassworm_njrat_smoke-loader.exe 6FE61B802D12D704036D3555194AC7472409DFFF355610595F37CEA7D45CAF28A7956C9DF052DD418C5A49EBD61BB8108FC00A71B5614432AAD2C708FDD636B1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3520.tmp

Path C:\Users\Admin\AppData\Local\Temp\3520.tmp
Size 5.4MB
SHA256 43ea697a98c306b276b8fc73782e0b1546b4e868b62a920cd45086ab2238ca33
MD5 821b84189945e3da5626820186a548a2
SHA1 32e8510c15d16aec05e883dfd15c4c6c4a68af7c
SHA512 16095390e819b2f9b73871ac71e805c08171dd51e8bd444238126dfc84d3861a903240889ae3a8d9e59c705ed0544cf8b30ced69ade4eb3b58f5a30f7bae05a5
SSDEEP 98304:pmhd1UryeATVQyp2Usi4IevVLUjH5oxFbxCVLUjH5oxFbx:plknsi4hvVUjZEdCVUjZEd
TLSH
T11E46F053EB918AE8E28D08776B554240D72EF621AB9F2351395C120CCF8738B9F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download