c7f26716f3ac1af4dbbd1a04c9c2416a88fe9adba660424200cc76975c7b3328

General

Target
2026-08-08_45c30a537d5ab7df1fb136c1aa52e911_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-d852dshj8s
SHA256 c7f26716f3ac1af4dbbd1a04c9c2416a88fe9adba660424200cc76975c7b3328
MD5 45c30a537d5ab7df1fb136c1aa52e911
SHA1 047be45a6778a3db28a51e6ff52cac3c9cf116c1
SHA512 c9dd18bbf09eecea4ccd6c6eb3ef6e192d611e6e5b2a403ad8a716e8d3fd493f3608c4cd5a10b10111317a1b979f9f450df76dc12dccc601ceeff7cfd7553bb2
SSDEEP 98304:x0nAAYEpahv9OU/jIEeQfoR/IuOFVjUu55:mNs9FIF0wuD
TLSH
T1AFF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4608	original_temp.exe
828	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_45c30a537d5ab7df1fb136c1aa52e911_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
828	original_temp.exe
828	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4608	3644	2026-08-08_45c30a537d5ab7df1fb136c1aa52e911_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	85
PID 4608 wrote to memory of 828	4608	original_temp.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-08_45c30a537d5ab7df1fb136c1aa52e911_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_45c30a537d5ab7df1fb136c1aa52e911_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\jds240674609.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240674609.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 76a3a40605f407f2f7fedb4f188690cf5bfdcbe2771f62b11fc5cb9df45af9b4
MD5 332a09ee785c1076c5f2b6624615f6d8
SHA1 5ff7c7888587a4f63274f4168103d05c44010b2f
SHA512 0570268248be4cc2dac425b71555414bb2b08b3c568069488c80deefc7cbfd4c5aca8cd266e7a27207a466a7ee244050a24475e19d06fe4e9c00eae7fa730b85
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjYA+wkT83npi63iB:W6F0eMpAAYEhpPhw68XpiMw
TLSH
T1A2756B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6378.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6378.tmp
Size 1.1MB
SHA256 ef4daf36dbb8d24213ec1b950010f7261316bc781eb059c86cad9f144f09b4ff
MD5 fdb4a7bcdd17cc189e119acc0bbd35e8
SHA1 3fca3cb252d7160bc31c4f89388ee4f97dab5887
SHA512 a16f7a12d00430e5862c4321d070b72d88e58dbe40e8b4b038acf9399735abc4f75f88c48ddba477b7c5daeaf06985a64f29ca4681e9e688ab6fb3f54a6d08b7
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcYA+wkb:u6F0eMpAAYEhpahwC
TLSH
T1B4456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX663A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX663A.tmp
Size 1.1MB
SHA256 b8132e28872e487f44f82068e2c675a6526ebcdbe07d8108bdde5a8c19c0caa4
MD5 16b257dba24d8691219ab6d44dd95338
SHA1 76337234efbcd428a796af046de6ebe32fa74c2c
SHA512 4bef1fba35e8bfe578653fd6e9d321bdb953530ae36af60bba4d5eed399aeb403869dc017e8d9516433868773dc40a070731a6b721cfc2dc3e5a8a9070987615
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+YA+wkj:N6F0eMpAAYEhpQhwq
TLSH
T1BA456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240674609.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 e4cf7c37a8b7d59dd65b28d5e7fce8256ba5fce1e52bb60c5cfa31faab6b8c23
MD5 e48024ec1c1586fe871d8406929e7c0f
SHA1 1c898419a0a116c33b6d67ff8e07e9627e66b1b9
SHA512 291466129408071072ccd21af15b7df256699e71a67cbf65a3f150ce5220ff4cd83c1ae5d306740f53f5e0cb2a687f65002080d6c4770d53e8c57d8a9dc167be
SSDEEP 3072:9KU3dWDOESN9n8p5VDzYDuIaifSnxC61dNyUy61dwBtUyu8Uy8Ic9hZBV6P9HFy4:1N9n8prfYDuIaifSnxC61dNyUy61dwBd
TLSH
T188F3304ADA2E84BE20534BD7D36D9C658EA2160A535E1A1831DF83CB7481D03CA6F5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 169KB
SHA256 46f5efea23bc86d03648e877103f0609b353da64e46dceea16c1f8a253e4b80e
MD5 7b6cabcbe3cd778607097dd0b0636fcb
SHA1 c8b8242f6c87569ba701c06f5d13f6c3f054d874
SHA512 2e3f5809bad7bdef753dbcc003005a5a82db0c7e4d3471ba431d47ec0b272664e979801bb19b8622a085b5f388532924d0cad1d7850c05d8c4553f5bf227bdf4
SSDEEP 3072:9KU3dWDOESN9n8p5VDzYDuIaifSnxC61dNyUy61dwBtUyu8Uy8Ic9hZBV6P9HFyq:1N9n8prfYDuIaifSnxC61dNyUy61dwBF
TLSH
T13A04404ADA2E84BE20530BD7D36D9C658EA2160A535E1A1871DF83CB7481D03CA6F5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3644-385-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads