Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 17:50
Behavioral task
behavioral1
Sample
2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe
- Size 8.7MB
- Sample260729-we2e8a1xhv
- SHA256 9af5749a2b42ebdb340903f6e0c5839f9267699ff142f2aee828f3063e89f4db
- MD5 5249cc8f4960b4b4120fec16da5745b0
- SHA1 6b30ccc8ef51410b945cab8b2e67722c606df6fa
- SHA512 d34328bdc3a5160dfdaf2d470cda035f91de7980bc475049a69164b8558bda8933470ce62c3951127a646ec601d68c57231a395d982bb95021aa83eb4eebe003
- SSDEEP 98304:ecKsDOFVoofxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22Iml2:eg6FaoaeGZF6bUpMBF1p/kjRm4OWi2b2
- TLSH T1BF96CE136EAC4061D0AF7D344D61D3D9A6317C108B22BA8B5ED07E9EEFB26D0792D631
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\calc.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\net.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\replace.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\sfc.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SysWOW64\more.com 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe -
resource yara_rule behavioral2/memory/4600-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c5df-5.dat upx behavioral2/memory/4600-500-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4600-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\r\AssignedAccessGuard.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\fodhelper.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\EaseOfAccessDialog.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_f22ff467d1513409\AppLaunch.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\Microsoft.ECApp.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ne-plugins-wireless_31bf3856ad364e35_10.0.26100.1591_none_b99784523fc95a77\BypassNRO.cmd- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_5c657b87715a8e52\aspnet_regbrowsers.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\directxdatabaseupdater.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_c055032b96806f80\wscadminui.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\r\CredentialUIBroker.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_a7b1b2421ae9ec27\WsatConfig.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\NETSTAT.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1_none_17ab113e28526647\WmiPrvSE.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\r\CheckNetIsolation.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.27000.360_none_22e4d76dba1efc07\vbc.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\r\charmap.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\r\colorcpl.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_f4339379cb9217a5\pwlauncher.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\r\UCPDMgr.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15912.0_none_d5e7146d665097c0\ngentask.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1_none_bf65878ace780f5e\shrpubw.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\wiawow64.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_6ee61d3ca59b8c86\csc.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCPROP.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1150_none_723b9016a5d6336f\printui.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\UpgradeResultsUI.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\ResetEngine.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\XGpuEjectDialog.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\explorer.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_810636a52f615c2d\r\psr.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_819025e8f7dd72e4\DpiScaling.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\r\netsh.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1_none_dc9627270e16a6e8\ReAgentc.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_1695d375c2f4d597\ServiceModelReg.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_2ce74853de1f47d4\raserver.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\regedit.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4ushowIE.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\certreq.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe- 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5249cc8f4960b4b4120fec16da5745b0_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.6MB
- SHA256 3b674b7a5fdfc674c6fb90191d9b15ff22c6dd41c3bc68081b27572d8dd460ae
- MD5 898f6bd6db6b033608ca04889a89860e
- SHA1 59d6f48c68456caf0794e35935c9f2493077d6be
- SHA512 c357ea4e7409924ae5851201f4abc07e6067ed1cf6d72a1f5fa3f7caf98adcead547e83dc6daac2528bf780cf9b5b6d340c3081076716ec6fd6956a4a6eea83c
- SSDEEP 196608:eg6FaoaeGZF6bUpMBF1p/kjRm4OWi2bk7:F6FnSIbUwF1VERmj2bm
- TLSH T1EDA6BE13AD6C4162D0AFBC758DA1D7D9AA313C014B21A98B0EC07E9DEE726D0B93D735
- MD5 SHA1 SHA512 SSDEEP TLSH