9e997aa3f25816bd261c4381d10d580ab08c7591bd7021b0b716c10a14105643

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:42

Target
2026-08-03_2873a80b5c50ab98e78b89039c225e81_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 11.2MB
Sample260804-pxln6abb29
SHA256 9e997aa3f25816bd261c4381d10d580ab08c7591bd7021b0b716c10a14105643
MD5 2873a80b5c50ab98e78b89039c225e81
SHA1 642c1258e362298ff174f56b9dacac100d0a9342
SHA512 416245edbb91612f711cfccc71624f492337d086ce976dfc9cf9a62bd8aeb2d2b99c41a90ed5712e9d514bad22d12b2ed64237115b05f9313f6611ded224128f
SSDEEP 196608:FKXLAGOearik86KSA+XBuCrCUCV6WaV3LvDB:IU3earik89SA+XBuCrC/U33B
TLSH
T1CFC66B22B345C036F55011B3A45AEA7963607D3A9B7094DBE3E1BE5A21F4AC30B35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/memory/4916-0-0x0000000000510000-0x0000000001043000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/4916-0-0x0000000000510000-0x0000000001043000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4144	4916	WerFault.exe	84
3352	4916	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-03_2873a80b5c50ab98e78b89039c225e81_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_2873a80b5c50ab98e78b89039c225e81_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
PID:4916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 192
  2⤵
  - Program crash
  PID:4144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 212
  2⤵
  - Program crash
  PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4916 -ip 4916
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4916 -ip 4916
1⤵
PID:556

memory/4916-0-0x0000000000510000-0x0000000001043000-memory.dmp

Download