1a2f602f6cf1b97a2cf08371b429cff55b620e70979b4c9e3e2b052de3b6e0fc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 4.1MB
Sample260808-d5qgjazamd
SHA256 1a2f602f6cf1b97a2cf08371b429cff55b620e70979b4c9e3e2b052de3b6e0fc
MD5 53906c7b797285d6b73156d27791c676
SHA1 24d1a4ac859dcd4c5b70457d5b960d0074c1bd19
SHA512 63463df4855ac1e1295bdcc6a3ace0b9bd87aa9bc0998fdb41eff0b25521602d16f5fe16783144fe1b504e8b58b5475c1a8a46f1ecb93242a15af3a7d7601fea
SSDEEP 98304:d0nAAYEpuqV9OU/jIEeQfoR/IuOFVjUu51:iNQqV9FIF0wuv
TLSH
T1DB168DD1BEC2B071E4A30571385AD2BD9533BC658932899BB3CFF71D5B319818A26B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
244	original_temp.exe
2440	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	original_temp.exe
2440	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 244	5688	2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 244 wrote to memory of 2440	244	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_53906c7b797285d6b73156d27791c676_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\jds240747140.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240747140.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX80B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX80B3.tmp
Size 1.9MB
SHA256 e2ca89246c7ccbd473b5703bba9c66253431250e73a7bace417596d5d938eb46
MD5 8825589845deb686377256ba23d47a39
SHA1 1911dbb2352f97a53bb61f6acdee0ce109591193
SHA512 4b3ce55c0c8e9a9060f72f9fa425f4fcc087ae28a26659eb12d96a8b36e18a0af2dda252df33cc3129119acdf5a99d021b5310833ed254ef0130b43ebe44b347
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8qTa:O6F0eMpAAYEhp1qe
TLSH
T13E952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240747140.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 1cb7f4f68759fb736251ce6048c658ca30bd74f4d4574ffd162ec501f80972a2
MD5 e3af7ba086717fbe901dd9604eb08995
SHA1 e63645ba635e4ab623ac67ddd23eec8369ed5092
SHA512 c6ba8dbf579dd449a1965a993bc351b82c57ed6e49494c12e18e778fcbec1f94766bf306c9965dda0967f80ed06aaa74cce231c2e385853b0a53f983852ff3e2
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBo:qos/
TLSH
T10EF343CA956FC5BA30234E83C77A6C754592355A835E0A2C62CFC2DF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 0fbec9f0965fe4840fab8abf4f89e121d28d98783904ff8826329c9b237cdd16
MD5 bf4d5a3020a8c898f7e7df09e3af2400
SHA1 92392ab9072b4e7e26f0f2b1a32430967e659f94
SHA512 e82b68ffa93470eda05f8de2387a48b5e3c5b3fb5dea4eea59218ced3f0fb0799420cdfc9f382208c72836960eb62afa853e4cfd3508d515dd6149a9ec780301
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBv:qosu
TLSH
T14BF343CA956FC5BA30234E83C77A6C754592355A835E0A2C62CFC2DF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 f2b001fa86508360fdf90731cc7cd8fc26465da576f0079007081f24c0087b82
MD5 f56d500bdae95395b3cab9aed8062cd0
SHA1 6c4e09e7b50f2bc8e0e7fd8fe0d1edfa18791f16
SHA512 3bd5ede65f4361ba26eaacc1c1b16e248e6a8daf4b9ff607cad16ad3dc65781802b8e5d9c71775d1239ca1e99f1c2e2ff078ac15e1271b90f23eb0954cebb000
SSDEEP 24576:WI7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOs6q2W:WD6F0eMpAAYEhpuqV
TLSH
T1B9952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 e3794704231869bab8c1f4fa0ed7aab90fcf93cd90c5edd5ac2f129563abeac2
MD5 9886f126cb93f5d6908178cde165a747
SHA1 f68ffaad9d21a513ac068389e4c509297a899106
SHA512 82b40297a8d223ee7df994475670bb668b0688a10a5cc54ad33e1879f2b3aea137b12631a8cc8bd86bf474f8ef2f59c831b030c2ba3041dfa510220614875b55
SSDEEP 24576:WI7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsqq6L:WD6F0eMpAAYEhpeqA
TLSH
T15C952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 e6589832b9ab6650c9c8b3e1e75e297f38449afc1f2c3ad136174dcf4d591289
MD5 39d5bd19c2ff1ce9b8301af5aa7ce6bc
SHA1 c49ab8f2d9354b9a44aeeaaf9ac1f357713b9c5d
SHA512 1a2f387a6f33be467c4284fd14abadb034e8f4e90ad9b79654a0ceca7d9520d8aaf1f12c4c1dd69221812059876cae32daefa8b1067ac9fefa1dfe9eb3de7ca8
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVqfQ:O6F0eMpAAYEhpUqo
TLSH
T1F5952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 228bc18ca8fd77a2f19cc4147dcfb006f649fac9eaeb2ff8180c7ba2b4d01461
MD5 fdb2bcf451f601ab36a847288818cd1b
SHA1 eafd41f78808935e59b39a13cdde3ed91c9d6fbc
SHA512 a6994b5f1139d3a97b6496d71b7dbf1df644b1f6146c80123318d1ac57836dbe022f132904850c6cd232180e56f7fde5637f5fc01b47772fbcd6a1e174064f94
SSDEEP 24576:WI7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsSq1q:WD6F0eMpAAYEhpmqM
TLSH
T10B952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 38209e08418ad54dbd4d732c81238f073d475234c71a0abf87998643541ac4c8
MD5 9e8c78f486beb088be6ba43bf89f2b59
SHA1 b4bf3f05b300731b0fbd0d39edfede4ede8f1d92
SHA512 30aad9db59a7bd7f1deb7cfaa1c142d432be15ce56c488404a0386838410f0cb9ae8f1d9609d6e9c783a4a81c4a5d98b99297f59b33c417a05eefd8aa4a606a2
SSDEEP 24576:2I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHqTS:2D6F0eMpAAYEhpqqW
TLSH
T141952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5688-321-0x0000000000400000-0x00000000005EA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads