81616b5d0bdcc6b82c65140e08dc6c98429ae162c1e280c436801dea8bdb9b25

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260804-h5lkssaj21
SHA256 81616b5d0bdcc6b82c65140e08dc6c98429ae162c1e280c436801dea8bdb9b25
MD5 515b6f9ebf221fbfc1e83c285c193e68
SHA1 8b3b2652540be6c876bb3e9e6dfd4f7bbe2330f7
SHA512 19ec9c10a60ae0392240f4f851ef7474d126c046e981d788e04c65a44b5e2ee8d906674c21076465437deede175db64684c5c1f6e977bd06074f06603e27d47a
SSDEEP 98304:Z0nAAYEpehH9OU/jIEeQfoR/IuOFVjUu5t:+Ns9FIF0wuf
TLSH
T149F59E11F6C6C4B1F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3592	original_temp.exe
4696	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4696	original_temp.exe
4696	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3592	2272	2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	85
PID 3592 wrote to memory of 4696	3592	original_temp.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\jds240695734.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240695734.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 f8de5d9caa74fd421d682ccd2ce8326590854a7a04aa07a461400b241f34f07f
MD5 962fb46a8c780b533526d63a4e607cad
SHA1 8b585a62203edfca5ca488e05293d2fbdd6817db
SHA512 dfcf609071e1ef987bbefb219ac604716d048b3da586dbd4893022dd5ca4fba746f17b237fede03b139315f7bd9543c1c2b1902693c058f8c7d97df2dcd7dc84
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOqYA+wlA83npi63it:u6F0eMpAAYEhpohwa8XpiMc
TLSH
T1AF756B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.7MB
SHA256 d37ae65f5e940d8132a4e06de1d7d3002ece5766498efc30c769fbd877ae28c0
MD5 d335dc59f4edc46cab8c7a9621dac5cb
SHA1 ce7578ba7a1d6ff81f84f3bb86eb51021ed73620
SHA512 2be1976640c3933e2cac88ed50444a3b8ab40653942cbe74bf87898c8f7977b41e55b1f5d9a83639e316b3a57d0e7e0191e9350c8169860abfd0bc7ad5373a18
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHYA+w4MDMysZgjS1hqgSCG:m6F0eMpAAYEhpzhwxDRjvQotoy4FE
TLSH
T14A859D70E64384F1E97301F2444BE7BA6934DE194031CD6BFBC8EE15BEB2952367A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB438.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB438.tmp
Size 1.1MB
SHA256 5458d4f5a67f8c95adb70fa6306d9d15d3afc874dfac66f1621d03e74fb81a4e
MD5 112c60c4d260abe371016714728a6e17
SHA1 da59fcca3996ca8c6c22b430a195c873689fa7a9
SHA512 1708722aa502238fa2f14e2514143ac0ea46885c7546b60721d73f78a1defb5dc811321b1711c88094acb916d9833b75a67133bc9d694767d19ff083195c1c21
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIYA+wl4:26F0eMpAAYEhpehwy
TLSH
T128456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB6CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB6CA.tmp
Size 1.1MB
SHA256 df9c4d67e366e400e4735642c027e8785d8d62c203547066194c54077c4ba745
MD5 f51c6cd1fcab9230b09d28a2cdceeb58
SHA1 83a476f8f5062656fb37c9c8efca32c2d71f11dd
SHA512 d904bab401dd7b2e7257ee427b958b63272dec784910ad227a5ab3bb114a31064944606d9decae9349f78b080676cc4a8ec154bb9c57743563213bc7780ab038
SSDEEP 24576:W7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+w4k:t6F0eMpAAYEhpAhwp
TLSH
T1D1456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB719.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB719.tmp
Size 1.1MB
SHA256 a485338b72b2e6e152620baf0c83504a1240ac1714a8a470df183c353a7f31cd
MD5 65a62f5290adfbf4704096c71c485195
SHA1 e84466d8db3fb4279f5c39c6ee8a4a282240748d
SHA512 9ec17749f094cd67bb0f4684138fc76fe54ae4fce75bdaaf7ba6b51e25c8e88ff138484d88f9c59b7d25943877679a2f809c571babaaca278f04f3751c625608
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlYA+wlQ:y6F0eMpAAYEhpJhwq
TLSH
T194456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240695734.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 3874de519a32bb1c99d5426f8718c1ad1698a836c131e698bbab128aeeb3e7b4
MD5 a06426b42a2362012241932cb7f39cfa
SHA1 036e5362dd159adf9bb9f83f0b5dc40834076d26
SHA512 3b51f6a9c09c3b890319f879b00bc3c3fe2e9d1c4908bc295a896da201e3ded4d65f4a1a1a9ef7c7d23879fc4b5455dabb15e14ed5d39fbb5a19345f8d76063e
SSDEEP 3072:zUkpXiHqUDsusNcBKQl/yrqkzJ7kkmq+ygeORpQKJJQg:r4JV
TLSH
T103F36486846E48FA38734BD7E3695D6486B3150F539F091C71DFC2AEA046C07C66E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 ddab2d8b309af8b1535321eb53c784b6f4cdbfd94fbcd1e799d9f1462df74515
MD5 08fe00251e4ca70a6776a5ca1db964fa
SHA1 7dc2d720748a8e2e1c00b5407a8c4ca10f98f936
SHA512 47e662bcf457ee7d67af8931c9e3e9389d5e68a1530eedf7f7d550844f21047d8f2138671079ce9ba54c19f2360e199495b552b336510cfa7296e77467ee6549
SSDEEP 3072:zUkpXiHqUDsusNcBKQl/yrqkzJ7kkmq+ygeORpQKJJQO:r4Jr
TLSH
T110F36486846E48FA38734BD7E3695D6486B3150F539F091C71DFC2AEA046C07C66E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-428-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads