6b784535a1d482582e9fd7c639c1f4ec01ad27bc8341de0a9f550608b2f295c3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 08:44

Target
2026-08-03_ff68e6d9749c2c408e134e52bd261a12_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.6MB
Sample260804-knhtpawbpc
SHA256 6b784535a1d482582e9fd7c639c1f4ec01ad27bc8341de0a9f550608b2f295c3
MD5 ff68e6d9749c2c408e134e52bd261a12
SHA1 c9995c67e225976e17fed7024315dbf87f252637
SHA512 e24dbc249db5836012f1f9a243ffd354da7002c89d95f5d21608b191f40e2276a2ee46a0019c19490fecdd86d2407e18801f06c969b475d546a84d78671b83c3
SSDEEP 196608:zSV7Rr+knK5ir9uSrdN4CjCYI/0BdQmsg:qFqknK5irASrL4CjC6bQJg
TLSH
T1BDB6BE23B245C036E55021F1681FAB5A63207E7A13B188CBF5E2AF6D16E46C74B35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/memory/4312-0-0x0000000000CD0000-0x0000000001775000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/4312-0-0x0000000000CD0000-0x0000000001775000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4992	4312	WerFault.exe	86
2496	4312	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff68e6d9749c2c408e134e52bd261a12_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff68e6d9749c2c408e134e52bd261a12_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 192
  2⤵
  - Program crash
  PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 212
  2⤵
  - Program crash
  PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4312 -ip 4312
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4312 -ip 4312
1⤵
PID:3868

memory/4312-0-0x0000000000CD0000-0x0000000001775000-memory.dmp

Download