234db4c4b60345f387d1f09727324b5ace54f231ba5a82d940b3490baa5f7c85

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-ej877ahl6v
SHA256 234db4c4b60345f387d1f09727324b5ace54f231ba5a82d940b3490baa5f7c85
MD5 1ea58145c6b262f6c5131a977350daa8
SHA1 44d32b15a04bee2c355cb82b6d45caa8172f86b5
SHA512 8f326ce666f0b87610c290b05b473046b31a7971c208c8e4ce9c5ab7a426546ce785b476b3cd1722eacf5448352fb36921016f4be10d15aecb43c4b126b7ea25
SSDEEP 98304:J0nAAYEpChB9OU/jIEeQfoR/IuOFVjUu5t:ONy9FIF0wuf
TLSH
T1B7F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3320	original_temp.exe
4500	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3320	4584	2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 3320 wrote to memory of 4500	3320	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1ea58145c6b262f6c5131a977350daa8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\jds240726031.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240726031.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 fb7c48a29200328bf8142cf028875b00acd2286757cc78483e284bde23a80e2c
MD5 2dda9794e007e577fcf1071ea715aa23
SHA1 e399d1fb3665f41eca94c5f380390f48704aed69
SHA512 18001bb4c184b1a208de65b36fee73dd946db163d0ec1ba4626f445168b48ac401d2e382de80cf3c2508709b357691fbeaa43776b58a622e864006a94191b86b
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnqFmRs47WXnueVulvspdbl:A6F0eMpAAYEhpeqY37WXnu6ulvKdfLMq
TLSH
T10CF539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2F18.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2F18.tmp
Size 1.1MB
SHA256 afca92f171830512762e312010611514fcb19c0369bb9810f0b4d128a7621369
MD5 9e3ec30f3a845f0a4868db5d70e7405f
SHA1 a7457f46f4f1ebe847df7f6ba320cd5452e8fff6
SHA512 38b7319a1a9feab11400ffbc5fd031bdb1776e2c044a89b43885589fcaa0bdd40a1af92c775f56792a826305cdb158621322fd72dd16d736577c7362d703465f
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6YA+wRt:q6F0eMpAAYEhpIhwb
TLSH
T15D456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240726031.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 7973799dc59f14930b4d3db61da9c210dfbe526bacb3cc48f94070a9a33af615
MD5 451e069fa5a8788ba89e9e9bce621e7c
SHA1 7ad5192e5c5fe03683edf566df61682bf1027b90
SHA512 10c6886b8c0adbd9d88621a6ac29bc5f997a6269ce49a78374fb32bf9efcfeb3a8c3672255833fd8cf40e3f12f5bc8aacd97c6b55d91284a83029d1646ed5d9b
SSDEEP 3072:bcMNjGN4qHNfkjGFIyJMNN1TNFT00aTt7duGHi6RNOs/:gW8Z
TLSH
T15EF35147866E44BA20134B97CB7A585C9B630A09479E0A3C71DFC2FE6545E03DB2E4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 b33a3f852344ba4f2397ec421f82f356600343942a39cec7e5762b77019a2527
MD5 03147aebf69848905ca6b16df02d0ba2
SHA1 d4fd207cb5414a9079ae942b6870410c705d38f3
SHA512 46ca775ac5421aa716fd672342f34780e1d20bc174d5e7dcb36527a1cf0eb6cb2e5a0155e821995f9382cf86bcdf995ea0d7a8b56a69a965fdbcaa8caf37cbe9
SSDEEP 3072:bcMNjGN4qHNfkjGFIyJMNN1TNFT00aTt7duGHi6RNOsL:gW8N
TLSH
T1AEF35147866E44BA20134B97CB7A585C9B630A09479E0A3C71DFC2FE6545E03DB2E4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 20b3ba96437fad80058608c78bc6adbbd52a06cd88d5c6ce5f89d829572579c5
MD5 f77490fca3c72367eecc27f235bd312c
SHA1 72cb05cb313b8934e2ac4f82e4b045320a76789b
SHA512 6f23bf53116662ad49edc4e7cc2b6ed28ea264a0ffb771a0f4746f64163488d22336bda29f1de6e811e1f937c44d36e4d09792d84ca023635cd7e5ece5aea12c
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoYA+w8F:m6F0eMpAAYEhpChw4
TLSH
T12A456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 041d436bd69cb58dc658d8e3f802d0722a1cfae4cc718c5f552daab4750a21fe
MD5 24d517efb1be4caeab379d4b0bed5ccb
SHA1 1aae734dbd48c2c8d59a1e170efa7e9e00210cd9
SHA512 7954e4418f7eef93d86a1f85a22842b9c054c1bde38f206cd0a751a7176ede441dafc394869204520904f4723fdae2e36dfe1bf154efd814072d370415395b2b
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9YA+wHR:m6F0eMpAAYEhpxhwx
TLSH
T100456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 37369f6cce575d7a0151948c1994b533c014123f22d08b88962134994c16be01
MD5 fa5ada4a26bb88624f509543fdc134ae
SHA1 8091477b9909ff14d567901a952ee55efa3a8c7f
SHA512 a4d23b81cb49b4e8a8a744dacce9df818ef1778b04537f151c4ac6559b43626f9b0f009a8648e3167878b60f482af76cf9cb5150888fbcaa0f1b89cf574bc068
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOWYA+wqk:26F0eMpAAYEhp4hwD
TLSH
T158456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4584-263-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads