ee74b7571c5461c2fe2760bef5506532662619f803c258f22d8f38f2dddf00b1

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_69d9be8a2baf202f74fc6a5d39978325_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-dzt8jasvdv
SHA256 ee74b7571c5461c2fe2760bef5506532662619f803c258f22d8f38f2dddf00b1
MD5 69d9be8a2baf202f74fc6a5d39978325
SHA1 b7a480562377fcb1251d344f6b306c64bdb5f8c4
SHA512 b05cebeb880f3bebb2d0c0c19ad98e18e37f84635bb27ba163af251e365023139d001d953bc4e20e32c7e34eb1056bad02d1244db65b64f6c058fe946801156c
SSDEEP 98304:B0nAAYEpOhK9OU/jIEeQfoR/IuOFVjUu53:WNR9FIF0wul
TLSH
T127F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4500	original_temp.exe
1020	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_69d9be8a2baf202f74fc6a5d39978325_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1020	original_temp.exe
1020	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4500	4376	2026-08-08_69d9be8a2baf202f74fc6a5d39978325_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4500 wrote to memory of 1020	4500	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_69d9be8a2baf202f74fc6a5d39978325_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_69d9be8a2baf202f74fc6a5d39978325_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\jds240733468.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240733468.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4BF7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4BF7.tmp
Size 1.1MB
SHA256 b5c3a714f880aaa1c81dc3109928d5d261f99f48f8f2836fede266aa12bb9a0c
MD5 93d2a894874bf1cf566fa7d0760c0c18
SHA1 e8744fd0756df4dde2995123302edd38e3142e6f
SHA512 264d346e0498f1185d45e0d8a68266465957656bfb1fc247899c44a13c73befd5f60bd18fc4fdff539bf9f89366210921a632dbd5ed67ce10205eb39ddac8d6b
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnYA+we0:u6F0eMpAAYEhpbhwP
TLSH
T172456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240733468.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 d4d6b08a8c45de60ed689d2bd59e512b3961af1130df50b5d879ff1ff60c51b8
MD5 7f90f318a6fc173572b1fbfc4bcf96a0
SHA1 b1230449953de225a81f94a3bcbb4bc6d3f30e6f
SHA512 6ab12086db6c99b2b8e0c7b733ad0b660e345d48e33c5cc6e821c034baf0c19c288a886be339df0b7eb5d4f5e418cd4bf5290c788b78fd296da8de82b3516329
SSDEEP 3072:DguRCDBLFX9HmT8PWAXRODmkntzSSoCclHs1bpcoM6LM58w3v:HuoM6LXo
TLSH
T194F333CA851EC9FB30239AD3C3795C655593265A839E491D23CF82EA7641D03CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 e73cfbf4b81aa1184fef00fb5e96427e00c45c72ea79ba30d5cfe98982812164
MD5 995ee40054dcfd67b54ba0a85c44d234
SHA1 c6707aee8cb5300862123d42a46ebd3176fb6330
SHA512 46b8a9574b6757e946d4e6608ef838e1b48cdb595b68423881e0260f862d199e376486ca1d4ab05fb0ef0c953dcfa858cd70db1a843cbaeabdfb5d46b28ee48d
SSDEEP 3072:DguRCDBLFX9HmT8PWAXRODmkntzSSoCclHs1bpcoM6LM58w3L:HuoM6LX+
TLSH
T181F333CA851EC9FB30239AD3C7795C655593265A839E491C23CF82EA7641D03CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 54de8d3ed4903d31b13b54ce65f169d9ee1ec225185b8103a88b308da0ca7582
MD5 f6d87c435c0afc81ce10210d7970a681
SHA1 830c700154f57c8b81f7bf27a9a40bb97bfece14
SHA512 00fa00f071ea1d20b1ea64d3df7f33bd1db9fbce7260e5282129f964385c6faf5b587a771319c888e8d882fb2d101792f3a5f9d09b9d379b5329f311c2453181
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOkYA+we8:+6F0eMpAAYEhpOhwX
TLSH
T120456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 55cee0217db8878d201301894e634557ddc9dcfe7c5000477df869e0f629e3a9
MD5 3575bda93dfa436a512993e4cbffc001
SHA1 6e4b8f6148246bb909b06d253aa2b7a833126947
SHA512 c6aa513ba45b8eeeac457ecd35ef164c2c7e0c86790810d23fe2484581d28db81e86b011633e1782f4b8542269fc873a60354ec7bdd84e8b25fb75d3f05e9fb8
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQYA+wru:+6F0eMpAAYEhpGhw6
TLSH
T123456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 41eb011f06f56c5bf187c733c6cea6c881ac64b1318835034559e3f0df2097a1
MD5 9a92b0d5a2e79a22d829151f28273ea5
SHA1 0dd636834d3a3f1a9c94d8e7670bcc64e2a4b083
SHA512 de0e2b9b07e510a5b74f65ce9aaf0161cf228e405ff54b9967cc58c626fd15fb6e26eb382ce63cb7cfc9daa3f7c6e9c4dd29d15d3c0028c110179d4557b79aa1
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4YA+wsQ:l6F0eMpAAYEhp6hwt
TLSH
T1FF456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4376-263-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads