c5f43f26bb02695d92998e917197b1b1c42ef4860e2021ed7bacab9b33a7d94e

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_7d42dafa7fb554cc835b7890405c2714_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260804-he8bwaee76
SHA256 c5f43f26bb02695d92998e917197b1b1c42ef4860e2021ed7bacab9b33a7d94e
MD5 7d42dafa7fb554cc835b7890405c2714
SHA1 c70c8c89d8c746b8853fdf8779c627aaede3583d
SHA512 d88f123c0e4ef062d6a96afb05c71db0999546e281f6687b0aa4d64a6e4bd8b7229401576f568df6f35e9d7ca19010c48dc355ca8e31a197d471e537abb58c95
SSDEEP 98304:U0nAAYEpmhx9OU/jIEeQfoR/IuOFVjUu5r:hNC9FIF0wuB
TLSH
T1C2F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5044	original_temp.exe
2012	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_7d42dafa7fb554cc835b7890405c2714_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	original_temp.exe
2012	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 5044	1404	2026-08-04_7d42dafa7fb554cc835b7890405c2714_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 5044 wrote to memory of 2012	5044	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_7d42dafa7fb554cc835b7890405c2714_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7d42dafa7fb554cc835b7890405c2714_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\jds240713531.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240713531.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXFB15.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFB15.tmp
Size 1.1MB
SHA256 6a44291ea0cdf113af66a99f9d1364abefc2b637d2961fc437ec5240c70debe1
MD5 e8928b76e9c594229b036ad5f5b107f5
SHA1 a4594420df8f2a50b0124d8f2c27822edce6bdca
SHA512 6c3b95786cd33db68ae4ce4d8eefcc8b48a61b50573576bb750e22604c962ffa5650fc753252ec74465a36915a58d5b1eea7e31915c73c2dede5ea34878949e4
SSDEEP 24576:W7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+wf0:t6F0eMpAAYEhpmhwc
TLSH
T147456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXFD4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFD4A.tmp
Size 1.1MB
SHA256 56ff6189c617b3188f4c491ee39c6b0c0cfa4884c590a34a2a284b140847eaf3
MD5 d62f2b8e8f29b0f421b815a43af4cadf
SHA1 5a9af378eba9db432a2d608e76ca3b0d844580a0
SHA512 5ab855b4fd47910808303b84e242e56b01c85562f5417fe50f53c0adf1f0d223d5dc9407ada2649ba632fefb28ac54025af0b026631af6076098abc9a8714b84
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHYA+wG3:26F0eMpAAYEhpThwI
TLSH
T15D456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240713531.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 3e020f963830484bc03cd80e0ebfccecda2d9879f8f6c56743fca5171a65bea9
MD5 0b107f009b1b92c204732e42895a163e
SHA1 d0022cf68f672876a7ff489b27cc4936b9bf677a
SHA512 88e99d80f17ca68f38893e58cb5f51ebb81103c9de083b2471bafdbd4f62808f83879904674ae318d011058108f2dd98f204a1e355025277185ab125309a121f
SSDEEP 3072:iokdkdxlz+PZk7W1wiJq7pz9M1n446zQPFkBgfbFGjv:9AJQ
TLSH
T1AEF3318A852FC5FB74238A8783795CB44593764E535E491932CFC2EEB641903CA2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 bc399091478c23ab12cee16acfcd7262fe4ed77c86837e8493fb842d22a514c4
MD5 f08f3f1631c8d2364052fd711b54d91a
SHA1 bbd5a66df4be3c88d4451eef4996ff4f31e944f6
SHA512 0c82654ae40876f74f80635ab2e6571a2f1d72d45a271aa5d56dcf1f366088b5e491448567d6f64d7e183625e0d7f441b8bc6c0a424ef091ce76420de713484f
SSDEEP 3072:iokdkdxlz+PZk7W1wiJq7pz9M1n446zQPFkBgfbFGjv:9AJi
TLSH
T1E1F3318A852FC5FB74238A8783795CB44593764E535E491932CFC2EEB641903CA2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4efafbb35293376bbe361e7bba7d267d1d21ee3ea970e410918f66d7142dd3a3
MD5 1eb289a68706ce2b5f63e753c00ee740
SHA1 a162aeebc6b74d5714687b914c7691d34877ffa6
SHA512 e5acc44113e14e5690c93794c4aceb8f52e14eb0c51306fe821c31c27f9918aa4ee1ae7411fe4a0b3a0f071db306de3dc4e467f5f24e3592c29c260118c40e16
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOwYA+wOG:m6F0eMpAAYEhpyhwp
TLSH
T1CB456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 2ed5f9040073c2b04ab791fd2ecb56ce11036987bc6848e4c13d248177d849c7
MD5 e44ae36819966ae8e283e38dd70b2c39
SHA1 a5705e9168c6c23c321c312b987ac41666242256
SHA512 2bbbd43acb58a8ed0d7c4688e1e23e4230e64d389ae18902bb5103e287a8a7297f6f74900e23c30444287061346b02934269c935d2287460a117389e085427a7
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOSYA+wGv:F6F0eMpAAYEhpAhwg
TLSH
T173456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-264-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads