f725296dc07087b810ed366217840e918f95a5f4422bf34b053bf1960d999d2b

General

Target
2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-c3fc4sbc29
SHA256 f725296dc07087b810ed366217840e918f95a5f4422bf34b053bf1960d999d2b
MD5 db05effe932e517f8fda4cfd613da38e
SHA1 8074ca0879f5e6a335c409481e4c645d8cce6c72
SHA512 2d902e0e02228a2ba3ee5334fe9298bba743112c188e9f7a7f62580f717feeab4a81ec338489d4891a8888c6b569b9431f5795a8ce1af34a285ce83fa55a168d
SSDEEP 98304:50nAAYEpKhB9OU/jIEeQfoR/IuOFVjUu5t:eN+9FIF0wuf
TLSH
T1BEF59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1764	original_temp.exe
2268	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2268	original_temp.exe
2268	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1764	3304	2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	86
PID 1764 wrote to memory of 2268	1764	original_temp.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\jds240668984.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240668984.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4CB4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4CB4.tmp
Size 1.1MB
SHA256 5170a5120da1de50d75305f246172a1540eb28553b08fdcbf2400a6136eb56d1
MD5 c5929b092792ab34004c02d94f62c86e
SHA1 0f647c44d12598131d45bc2dea1d95a5a62ce242
SHA512 97e031fcf4c79e5d37ebdec1f7663266b5f53f2fbc4831af8211e25d3ed8662ecde0dcadde66f88032c478ecd48fdbf8367c08b4abbdb214f6ab916426c431d0
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+wsR:W6F0eMpAAYEhpKhww
TLSH
T1D0456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4F08.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4F08.tmp
Size 1.1MB
SHA256 bc1e25c8aaca39df7c3ad22073741c78fdef9924f2754dcc614b56e2374965d6
MD5 54b814ed7793314b022a4e1ec3f5e898
SHA1 2e8b5881dc5937e80fc50e266430528647a2e749
SHA512 1cfaf0487d2a72dc80f2c807d7278e94c1986ee8d0d854178eee80a003ad40f75c37cfcc3031a849dd8a3e0bf7c374cbffc3359424bd5e9c96b8790e86cba292
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+wRF:m6F0eMpAAYEhpChwz
TLSH
T191456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240668984.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 10044ed8e6a827443063c05808a1b88acf355f18a8f33c7f55e7d025c0e6b7b9
MD5 a25269517dd2fa9421e45797b89371c7
SHA1 e2d92b2874be0b19b0602c397ac4d6130d92935e
SHA512 658df1a0bf0fd3c78df4a157122bfff31c2256a09578ba855ab9fd45c94df12a580e7ad8628e296945bcc5d566fa895107716f6b1b4d0362062aa2d736aa7a70
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObS:kuG6L
TLSH
T122F3214A862D88FA34235FC3C3AD5E658E920A09535E0A5C35DFC6DE7485D03892E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 166KB
SHA256 be51b63c0d2cf642dae112fea7815e59516b92368aaeb9989a1f75522693c085
MD5 6d5913f354ab0cfd91733153f336777e
SHA1 22a562dc3eb4714f23f8577eeda42fe2b25ee666
SHA512 cb6a79989cb569129e9e307fe1df5e8afa1769f7fa364c352c3e27dd391567a48b659cf3731779337235600e43b07b68bb8afbb0bf9a24650e78961cccd37ae2
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObk:kuG6L
TLSH
T1FFF3314A862D88FA34335FC3C3AD5E658E920A09535E0A5C35DFC6DA7485D03892E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 da449be5858fd86b40d9376721036bbabdee946b7535253390da45b451a4afb0
MD5 9208bd44b992383064b25a2895224a4d
SHA1 6526ef795f4ca4813efc0ca52132ed3a54b1d0cc
SHA512 a5deb41cb1642f1cc8f1ef5f045b052310caf8772c0653c1647e0a615e811cfd27c0f37c7c1a03e41c90ec4e825fdc454245540e9addbf60a622d8a09a9132e0
SSDEEP 24576:R7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+ws5:C6F0eMpAAYEhp8hwY
TLSH
T142456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3304-411-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads