1a2f602f6cf1b97a2cf08371b429cff55b620e70979b4c9e3e2b052de3b6e0fc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 4.1MB
Sample260808-d5qgjazamd
SHA256 1a2f602f6cf1b97a2cf08371b429cff55b620e70979b4c9e3e2b052de3b6e0fc
MD5 53906c7b797285d6b73156d27791c676
SHA1 24d1a4ac859dcd4c5b70457d5b960d0074c1bd19
SHA512 63463df4855ac1e1295bdcc6a3ace0b9bd87aa9bc0998fdb41eff0b25521602d16f5fe16783144fe1b504e8b58b5475c1a8a46f1ecb93242a15af3a7d7601fea
SSDEEP 98304:d0nAAYEpuqV9OU/jIEeQfoR/IuOFVjUu51:iNQqV9FIF0wuv
TLSH
T1DB168DD1BEC2B071E4A30571385AD2BD9533BC658932899BB3CFF71D5B319818A26B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2952	original_temp.exe
1284	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1284	original_temp.exe
1284	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2952	2904	2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	86
PID 2952 wrote to memory of 1284	2952	original_temp.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\jds240647109.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240647109.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXF702.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF702.tmp
Size 1.9MB
SHA256 f2b001fa86508360fdf90731cc7cd8fc26465da576f0079007081f24c0087b82
MD5 f56d500bdae95395b3cab9aed8062cd0
SHA1 6c4e09e7b50f2bc8e0e7fd8fe0d1edfa18791f16
SHA512 3bd5ede65f4361ba26eaacc1c1b16e248e6a8daf4b9ff607cad16ad3dc65781802b8e5d9c71775d1239ca1e99f1c2e2ff078ac15e1271b90f23eb0954cebb000
SSDEEP 24576:WI7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOs6q2W:WD6F0eMpAAYEhpuqV
TLSH
T1B9952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXFA59.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFA59.tmp
Size 1.9MB
SHA256 e2ca89246c7ccbd473b5703bba9c66253431250e73a7bace417596d5d938eb46
MD5 8825589845deb686377256ba23d47a39
SHA1 1911dbb2352f97a53bb61f6acdee0ce109591193
SHA512 4b3ce55c0c8e9a9060f72f9fa425f4fcc087ae28a26659eb12d96a8b36e18a0af2dda252df33cc3129119acdf5a99d021b5310833ed254ef0130b43ebe44b347
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8qTa:O6F0eMpAAYEhp1qe
TLSH
T13E952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240647109.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 38b7af28ae8b0b0e4db43621d222717421ca21fa9db83c12fc96f9379289453e
MD5 802fd0f45b02ab493ad021b443aebdc5
SHA1 267832dcf108fcdf344acd2ff7161a38abf42390
SHA512 0fc89787c290d0defad3b36b7dfc97a9d7275f355489349753567d7261f8b304432a0cd2f0514a45b8746cb1764437556a0742bf46d5392fa4d7075a7564590c
SSDEEP 3072:To3RYJ5hnwqqYoJxVlFej1Lhcr1WWYgO4Hg2cjhGYO4:gQUe
TLSH
T1A4F31F4A862EC8BA64634AD7C76D5C659FA31509439E0A3831DFE6CE7480D03862F5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 c6dbf48cc6ca441937b1797603d39417db49c82ae178fd191855ef431a2202a5
MD5 bc38759e6664d9baaf36a214b5a810f7
SHA1 d9915f27a5c959358f8610ef85cabbb6e50a7f75
SHA512 5bf95fec6f27ce56677f2e60026be6c9a68d600887ca00586d930383db5bd6c697a125a61eb3a86007dc14747a5bae1fd160b033839b3b1e99a9486713b67aea
SSDEEP 3072:To3RYJ5hnwqqYoJxVlFej1Lhcr1WWYgO4Hg2cjhGYOu:gQUA
TLSH
T1EAF31F4A862EC8BA64634AD7C76D5C659FA31509439E0A3831DFE6CE7480D03862F5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 38209e08418ad54dbd4d732c81238f073d475234c71a0abf87998643541ac4c8
MD5 9e8c78f486beb088be6ba43bf89f2b59
SHA1 b4bf3f05b300731b0fbd0d39edfede4ede8f1d92
SHA512 30aad9db59a7bd7f1deb7cfaa1c142d432be15ce56c488404a0386838410f0cb9ae8f1d9609d6e9c783a4a81c4a5d98b99297f59b33c417a05eefd8aa4a606a2
SSDEEP 24576:2I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHqTS:2D6F0eMpAAYEhpqqW
TLSH
T141952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 363de4d3f20a5dff1d60a0c6f52007a7bf2c52e22ec925f0b5120bc19982b0a9
MD5 19219843c0335b064b9fee48e30a9bee
SHA1 fd6d439b59e5315754ad12450912797d43306431
SHA512 eee187042040bcde7622bbd6f30a8007fb2b51d6c790e354ff922c086525034f60682fb6e22abf0741a3b3bed019207aed4a85f5eccc8345379afdcfcbf2e58a
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO0q2u:y6F0eMpAAYEhpRqt
TLSH
T1D1952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-420-0x0000000000400000-0x00000000005EA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads