234db4c4b60345f387d1f09727324b5ace54f231ba5a82d940b3490baa5f7c85

General

Target
2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-ej877ahl6v
SHA256 234db4c4b60345f387d1f09727324b5ace54f231ba5a82d940b3490baa5f7c85
MD5 1ea58145c6b262f6c5131a977350daa8
SHA1 44d32b15a04bee2c355cb82b6d45caa8172f86b5
SHA512 8f326ce666f0b87610c290b05b473046b31a7971c208c8e4ce9c5ab7a426546ce785b476b3cd1722eacf5448352fb36921016f4be10d15aecb43c4b126b7ea25
SSDEEP 98304:J0nAAYEpChB9OU/jIEeQfoR/IuOFVjUu5t:ONy9FIF0wuf
TLSH
T1B7F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4692	original_temp.exe
4340	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	original_temp.exe
4340	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 4692	5972	2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 4692 wrote to memory of 4340	4692	original_temp.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Users\Admin\AppData\Local\Temp\jds240695609.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240695609.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXB561.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB561.tmp
Size 1.1MB
SHA256 20b3ba96437fad80058608c78bc6adbbd52a06cd88d5c6ce5f89d829572579c5
MD5 f77490fca3c72367eecc27f235bd312c
SHA1 72cb05cb313b8934e2ac4f82e4b045320a76789b
SHA512 6f23bf53116662ad49edc4e7cc2b6ed28ea264a0ffb771a0f4746f64163488d22336bda29f1de6e811e1f937c44d36e4d09792d84ca023635cd7e5ece5aea12c
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+w8F:m6F0eMpAAYEhpChw4
TLSH
T12A456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB7F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB7F4.tmp
Size 1.1MB
SHA256 02a04f929a73ef2ca23b787b04cc7f81e3122bb47c82ea87c5dbd7546e3bb2f8
MD5 7bfbe4650a2a9d544b0837cc757c4bf0
SHA1 c2d151a79e0c15990ebfa3b6771e9c0cf8803ebc
SHA512 6eecd415756c0b423bd0eb3a38196566b87acc5ec46b36658056043bad92244de223ec1130b38c3906fe722bcd8929d7670bcc3e8f65f7e7ec361fca9cf74ad7
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6YA+w8t:q6F0eMpAAYEhpIhwA
TLSH
T101456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240695609.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 43812fce1f45334db8271fc5d9d37929ce946cfaf59ce3b2fea72191f2dda28c
MD5 59c332669778f400110b8605a2549e56
SHA1 28588d5badfaa78ff691c07314c8fa92dc504aee
SHA512 8ac869ac76f78b025472f3982ad15ac485c708c0c04e89896bbf9cced49e0f41ce746c9d3fae3c5b2d4c01ceba0215965dcf7fbc42bef97c3a33513099f8268e
SSDEEP 3072:q0Gr8nZoV59XTtSohUBWYFXenGsVsKttTV0kqOf8R10EmiFBuG7VqWaQG7VIBXa5:q0GXyEEmiFBuG7VqWaQG7VIBXaQCqaQS
TLSH
T1D2F3128A892D89FB34634BD7D36A5C549E921509479E092C36EFC2CE6845D03C63E8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 178KB
SHA256 d58a013895f2a6957bd969fc90aaf20acc6e6b53c41d822312df3edf1b30a094
MD5 1fb66c34228fef8c2283427e4e58c6aa
SHA1 e655429d723488cec03b284cfea4b6cc5714d9ce
SHA512 a4e70c9a4af775b8c49306ba0dca38dd07faec2a9a2add629b70a63f1ff87c0d2bdb1df2c6d5c2ffd51bff5f30f5cdf71b382f7edc226abbaa664f656e59fa58
SSDEEP 3072:q0Gr8nZoV59XTtSohUBWYFXenGsVsKttTV0kqOf8R10EmiFBuG7VqWaQG7VIBXaU:q0GXyEEmiFBuG7VqWaQG7VIBXaQCqaQR
TLSH
T1FF04228A952D89FB34234BD7D36A5C549EA21609479E092C32DFC2CE6945D03C63E8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5972-440-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads