81616b5d0bdcc6b82c65140e08dc6c98429ae162c1e280c436801dea8bdb9b25

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260804-h5lkssaj21
SHA256 81616b5d0bdcc6b82c65140e08dc6c98429ae162c1e280c436801dea8bdb9b25
MD5 515b6f9ebf221fbfc1e83c285c193e68
SHA1 8b3b2652540be6c876bb3e9e6dfd4f7bbe2330f7
SHA512 19ec9c10a60ae0392240f4f851ef7474d126c046e981d788e04c65a44b5e2ee8d906674c21076465437deede175db64684c5c1f6e977bd06074f06603e27d47a
SSDEEP 98304:Z0nAAYEpehH9OU/jIEeQfoR/IuOFVjUu5t:+Ns9FIF0wuf
TLSH
T149F59E11F6C6C4B1F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3896	original_temp.exe
6120	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6120	original_temp.exe
6120	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3896	1536	2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 3896 wrote to memory of 6120	3896	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_515b6f9ebf221fbfc1e83c285c193e68_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\jds240722921.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240722921.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX1F85.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1F85.tmp
Size 1.1MB
SHA256 5458d4f5a67f8c95adb70fa6306d9d15d3afc874dfac66f1621d03e74fb81a4e
MD5 112c60c4d260abe371016714728a6e17
SHA1 da59fcca3996ca8c6c22b430a195c873689fa7a9
SHA512 1708722aa502238fa2f14e2514143ac0ea46885c7546b60721d73f78a1defb5dc811321b1711c88094acb916d9833b75a67133bc9d694767d19ff083195c1c21
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIYA+wl4:26F0eMpAAYEhpehwy
TLSH
T128456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2237.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2237.tmp
Size 1.1MB
SHA256 f203bff740211fb50bb54cfef915e5f234859af53bc0ac4c944eb329fd8f35f3
MD5 568d012df77f69e8957d317400f99b6e
SHA1 7db0fe626f439aa99ec80ab6b9396fd91ce5d962
SHA512 8fec0712d302d6a1f6413bb193dfa5001fd706fd3ce082860ebe1759ec1e07477f4d9e4ffdfee1f518ba3f95731ce3a9118e0c825485dc91266a749f7a494cb7
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHYA+w4M:m6F0eMpAAYEhpzhwx
TLSH
T1D4456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240722921.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 5ebce6c1faa9fcf0082469199d0b3113dffd2b5d29a0dbc2142b4392347fcec3
MD5 52b1c774c1dae62dd2464f33ca55e76a
SHA1 6548de51a40a988a2c7abce0079c9ecf1682f648
SHA512 1f76f11d8ad5f2a537909e75562e2caa887f37e4cbd32543cf2b2d785a1fd214ed1b2b57fc99e70bf2380e267a8e0a1899f39f6919740d898b5a2cf920828b5d
SSDEEP 3072:YsCVL+3m+PvFz6AZEfeTdmo9Alec55oTg2MzRYYCtDlefHeAPRCRS:Zz6AZEfeTdJxcR
TLSH
T12CF32186852E44FB34138B87C3BA6C7445A6255F53AD891822CFC6EF76458038F6F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 7f4b261b5ee277e70ef701d26e3d80aca2159669b6c49037da9e0b9dd689208c
MD5 26a7d7a456c704c02695208021640bfe
SHA1 392263eadfa3d937ac24665b4cb9a65b31c987b6
SHA512 fd24c093591876efd1f9f49670810c1823e2e4642b9d317e306dafd040ce018ac4df5cb440aa9f30956acd99f85acbee737aa64117b78fe3f9bddc418b1f927d
SSDEEP 3072:YsCVL+3m+PvFz6AZEfeTdmo9Alec55oTg2MzRYYCtDlefHeAPRCRz:Zz6AZEfeTdJxcm
TLSH
T1CBF32186852E44FB34138B8783BA6C7445A6355F53AD891822CFC6EF76458038F6F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a7e7587277f6fb6306914c5292cf1a47cce8acfc4984bab067fcdbe8b7159b83
MD5 4dbbd3a0a69c8f2c7a2479b164dc339e
SHA1 39035d7d1fac16a5d4dfbf3b0b704e6a01034b30
SHA512 f189baa47c464d251512bbaa7d47e6f85c267ada245318ae06c6a6a21f1a7ba14987c63330feffefb408a18b19b7a5a0495f8527ec24ddc6fc062a026ba95f07
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4YA+wIK:26F0eMpAAYEhpqhw/
TLSH
T1CA456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 df9c4d67e366e400e4735642c027e8785d8d62c203547066194c54077c4ba745
MD5 f51c6cd1fcab9230b09d28a2cdceeb58
SHA1 83a476f8f5062656fb37c9c8efca32c2d71f11dd
SHA512 d904bab401dd7b2e7257ee427b958b63272dec784910ad227a5ab3bb114a31064944606d9decae9349f78b080676cc4a8ec154bb9c57743563213bc7780ab038
SSDEEP 24576:W7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+w4k:t6F0eMpAAYEhpAhwp
TLSH
T1D1456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-263-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads