3b3328f8f9bbc3f2be33feeff05c0e5e2c1571fc4a4698509ee2433434463d04

General

Target
2026-08-04_f93654f75721c23a0e4cae7e9bf8e813_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260804-ffls6afr3v
SHA256 3b3328f8f9bbc3f2be33feeff05c0e5e2c1571fc4a4698509ee2433434463d04
MD5 f93654f75721c23a0e4cae7e9bf8e813
SHA1 37e23f657d054bc6231daa63eb0f8517b3fdca57
SHA512 8ac0d7847f7a4681301ca27e936a63a6ea56699fd4a41c2c254338ee173adaac1ea0d451dd8c3f040cdbc62e20a538be3706d8c9ce509308b21b75cae2f6ab9f
SSDEEP 98304:c0nAAYEp9hN9OU/jIEeQfoR/IuOFVjUu5r:ZN79FIF0wuB
TLSH
T1DCF59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4616	original_temp.exe
2476	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f93654f75721c23a0e4cae7e9bf8e813_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	original_temp.exe
2476	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4616	4888	2026-08-04_f93654f75721c23a0e4cae7e9bf8e813_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4616 wrote to memory of 2476	4616	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f93654f75721c23a0e4cae7e9bf8e813_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f93654f75721c23a0e4cae7e9bf8e813_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\jds240725234.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240725234.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 d55527853734fcc4476fb9137b24b975b86aa3eb067c33816b5a90af8504e0fd
MD5 2a014140e519cb0d59f6455f5438fc67
SHA1 9349b11acc5433ae20681779fd22027b826a8e26
SHA512 ee82b490e9321a02c409597df63a80d87e11d99018570d9ed16e0589d8d601fd77990df170376734563e7db67b3581e898cd2b5c7415d8a64901a4bcf28c3bff
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+whWnMYenGJiKEbXWtQ:G6F0eMpAAYEhpyhwsMPnRWt4N
TLSH
T14B759E74E783D4F1E92300F1444BE7BA69349E1944318C7BEBC8EF15BAB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2949.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2949.tmp
Size 1.1MB
SHA256 785ae38b5589edf7a4085c638813cceb88399c3ac5e6bd7d4a073228a6fd6958
MD5 78fc0ef54210c1c377e5a0b9b88aa6df
SHA1 b5143d8c4e36c65d583ddf9636936fd519ab9815
SHA512 f7501a62b8d4e92e7092645db96b490dfc762b4c37d1c7a76539998c693249aaee7d300dfd17abe6140b5d9b314f9afd74859b78fa5bd56d6f43024158de86ac
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wh+:V6F0eMpAAYEhp9hw0
TLSH
T19B456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240725234.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 d74670ac1f5b4a305a73488e3c47653e00a2c6f78ec5f6b2e3dfe3dfdaea608c
MD5 90445d70c95d7b9db444daf681438c13
SHA1 770b956d2f6a96b13df507b8cc4875da63ae8500
SHA512 1db465aeb820f2f6d9b1ce56e0d5dfb67bcc8b314a8cf8a1f22f1a4c4017f32ede7750f7b9026d73376d9736dd762d9331cf86dd4417cf4a03133a6cc8465eaf
SSDEEP 3072:DguRCDBLFX9HmT8PWAXRODmkntzSSoCclHs1bpcoM6LM58w32:HuoM6LXZ
TLSH
T16EF333CA851EC9FB30239AD3C3795C655693265A439E491D23CF82EA7641D03CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 a0b4f0c5b5d574772efbda6ba3d3b52c410d8432fb7d4e9f1911ca522a990556
MD5 3511eb4a5a8dac3f127fb285ec896fc0
SHA1 7f2762a70df68b6ac20343e8533a10c0bb4b8f61
SHA512 06f8afeba9409927292823eeb9190864db6db62b862ee6d4359cf1259392f735a92ade9c692b460c71d0e848058ebb5d6f7bea00973f32f574cdcc4bdc7237d3
SSDEEP 3072:DguRCDBLFX9HmT8PWAXRODmkntzSSoCclHs1bpcoM6LM58w39:HuoM6LX4
TLSH
T162F333CA851EC9FB30239AD3C7795C655593265A839E491C23CF82EA7641D03CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 242870dc36293e1eae137016624cd4ccf1857f22984fb0396200414a43910f53
MD5 2dd98dd9f47766eca9c5cba54bfd2877
SHA1 9216e921e355e27efb63f2c36f21b7c98695d370
SHA512 2b072d5340d5fb6996a20bb61361db8971b49d76be3bd10f3a76ff5a0181efe03d39d89c0e707c30287b8703f797a2c92119f5647dc8ad95718a2fd2fefb76a3
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOGYA+wY4:26F0eMpAAYEhpchwp
TLSH
T100456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4888-264-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads