f725296dc07087b810ed366217840e918f95a5f4422bf34b053bf1960d999d2b

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-c3fc4sbc29
SHA256 f725296dc07087b810ed366217840e918f95a5f4422bf34b053bf1960d999d2b
MD5 db05effe932e517f8fda4cfd613da38e
SHA1 8074ca0879f5e6a335c409481e4c645d8cce6c72
SHA512 2d902e0e02228a2ba3ee5334fe9298bba743112c188e9f7a7f62580f717feeab4a81ec338489d4891a8888c6b569b9431f5795a8ce1af34a285ce83fa55a168d
SSDEEP 98304:50nAAYEpKhB9OU/jIEeQfoR/IuOFVjUu5t:eN+9FIF0wuf
TLSH
T1BEF59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2712	original_temp.exe
5864	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5864	original_temp.exe
5864	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2712	4148	2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2712 wrote to memory of 5864	2712	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_db05effe932e517f8fda4cfd613da38e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\jds240743031.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240743031.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX70A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX70A5.tmp
Size 1.1MB
SHA256 afca92f171830512762e312010611514fcb19c0369bb9810f0b4d128a7621369
MD5 9e3ec30f3a845f0a4868db5d70e7405f
SHA1 a7457f46f4f1ebe847df7f6ba320cd5452e8fff6
SHA512 38b7319a1a9feab11400ffbc5fd031bdb1776e2c044a89b43885589fcaa0bdd40a1af92c775f56792a826305cdb158621322fd72dd16d736577c7362d703465f
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6YA+wRt:q6F0eMpAAYEhpIhwb
TLSH
T15D456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240743031.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 6313ed437b9ace033dc11c16f59765414c56f541d1e7629cd2dd0ac3a80b2357
MD5 92fe8a6284c2cbca7cf84e7ab0f031a6
SHA1 1689a3814885aaed51ea6b86796855526206bcb3
SHA512 85920e41155f0f4a25215961db31c2b2b6becb54fc1db8b0585e04f2d6ae38a1f691cd076302100b05f78e11e6a19c82064048f7a417dfb76543ce6fc072164f
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBD:qosO
TLSH
T131F343CA956FC5BA30234E83C77A6C754592355A835E0A2C62CFC2DF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 d3fbce0bd18e233bc0ee7e6f5868d447ab363f6666d903970e437b6c114006b3
MD5 60916cd2b42daf4adff793581df28a0b
SHA1 ebd5d78ad1d783f374d5c8dc41624c424dc1057d
SHA512 27a754db0b0a96e0fa0a52d08573a83dbf4808ee7a30b6ad155288f393ee211017791e9af491cdd6d5a254042018cd66277d4c28faf3d23318eb9f3866184bcb
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBX:qosQ
TLSH
T116F343CA956FC5BA30234E83C77A6C754592355A835E0A2C62CFC2DF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5170a5120da1de50d75305f246172a1540eb28553b08fdcbf2400a6136eb56d1
MD5 c5929b092792ab34004c02d94f62c86e
SHA1 0f647c44d12598131d45bc2dea1d95a5a62ce242
SHA512 97e031fcf4c79e5d37ebdec1f7663266b5f53f2fbc4831af8211e25d3ed8662ecde0dcadde66f88032c478ecd48fdbf8367c08b4abbdb214f6ab916426c431d0
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+wsR:W6F0eMpAAYEhpKhww
TLSH
T1D0456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 dd00cf733f806e4909227d785ff2e0469138c458cb3822313b533f34ef138a1f
MD5 0f96e1aacf81bfa63dbebad4d66852a9
SHA1 01c82b7836139d72cf797085b5f7fb51348a5be5
SHA512 70fee3d45fd49f6e5d3cb93ada42252cbe7ad2ed05f05d33c49d4a9a339154a8655e2e135b257af047ec4a84022aaa4be429c02959a9939b7f612c97958b1d69
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdYA+waB:26F0eMpAAYEhp1hwG
TLSH
T112456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 374864d9c159ed3e389c24a184b869e2c449e3d6507f754d8eceed2dd67d45d9
MD5 47ff393812b0dd4ba1d63297f558a32b
SHA1 4b47bb99dc6795de5a646c8f2a5b933f85096325
SHA512 93167388378e754ce370c7f3969193c40362aa7c6f4a3879d547797da1111ead7f12f7334da0737b9138f969ce776c2642749ab8ef91703a194ce66430f65b65
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnYA+w3F:W6F0eMpAAYEhpLhw1
TLSH
T146456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 bc1e25c8aaca39df7c3ad22073741c78fdef9924f2754dcc614b56e2374965d6
MD5 54b814ed7793314b022a4e1ec3f5e898
SHA1 2e8b5881dc5937e80fc50e266430528647a2e749
SHA512 1cfaf0487d2a72dc80f2c807d7278e94c1986ee8d0d854178eee80a003ad40f75c37cfcc3031a849dd8a3e0bf7c374cbffc3359424bd5e9c96b8790e86cba292
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+wRF:m6F0eMpAAYEhpChwz
TLSH
T191456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-264-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads