3d4ef597f3ea7617fd278ead02f0c90b23aba9a89e369e4402c9f8e8723c33b2

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_0cedab5c8f37185e30972c9a0a78b7ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260808-eq4w2ss1dv
SHA256 3d4ef597f3ea7617fd278ead02f0c90b23aba9a89e369e4402c9f8e8723c33b2
MD5 0cedab5c8f37185e30972c9a0a78b7ce
SHA1 ebdc611752f9d75273fd46561c2686b99b8daebb
SHA512 48a19abdbc3184cb9121c91e8b46ee28f3ef458f0a79c8c950b20cb9c71c1e527020e373bfb034894abc7f4d63e1e9f19a1cc7ab22b8a178d3026ca82b8c8d41
SSDEEP 98304:Z0nAAYEp1hk9OU/jIEeQfoR/IuOFVjUu5t:+NG9FIF0wuf
TLSH
T1DBF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2996	original_temp.exe
6020	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_0cedab5c8f37185e30972c9a0a78b7ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6020	original_temp.exe
6020	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 2996	4204	2026-08-08_0cedab5c8f37185e30972c9a0a78b7ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2996 wrote to memory of 6020	2996	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_0cedab5c8f37185e30972c9a0a78b7ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_0cedab5c8f37185e30972c9a0a78b7ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\jds240735906.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240735906.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 01c17677f91c9b7a75db16cdaaeed471008c0869f58a0d062cd8e334dcfe59fc
MD5 1998759b1ef4fea0590c59005f44613b
SHA1 7a1b581ab4d1c5fa8c434bc9130a8c5b4cdf5107
SHA512 2185d9cc6f32e11fe5be1345be32a408883893c113dd385f44997923c3569efe5f2c1493b05ce1a1b72bef979c357805708a5e2efb5d36f184293fcdcedfc914
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsYA+wQx83npi63it:u6F0eMpAAYEhpihw88XpiMc
TLSH
T193756B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5105.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5105.tmp
Size 1.1MB
SHA256 5fa4e6f5a7d1dd072ee375fc16b75f6a03fd2ee01d0bfc830380c526b7672b75
MD5 d74af2ddf790ed0bcc59ca7c577c1453
SHA1 86a2b0f9dedbebb8d884e6bf1211543fb6cdf9c4
SHA512 0ed0d35f991a21a39c6ade7f6df9aecbc62eb93a2449f73900563259953e18ee123847daaee955a5f2da123adf99b062b32152dbd87e3f27f35d1b67de0e0d77
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBYA+wHl:26F0eMpAAYEhp1hwF
TLSH
T1CE456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX54E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX54E0.tmp
Size 1.1MB
SHA256 bd270d994c9f103dd7266574638994dda0fa3b342a7572939312935387e4f0c4
MD5 701e84c5a9d9471d1cbdcc084847bd5a
SHA1 d6ca726967c3bda3adb728fd8793b6c1598b0825
SHA512 187050b10551a377db131428baea2e0c92c51da1fd93669f659a465006fe887e579832d790bf43cea1a8e488a17a812400b536b4796aee2da2d2f1b636c4cc71
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOYA+wGt:i6F0eMpAAYEhpAhwa
TLSH
T1C0456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240735906.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2c50fee12c7c2d2779ab8f2dc1e185aff3d9f32614cc324da5a4c4d71c02a7d0
MD5 7a4b9e8f02b98dcf8d72b0485440f315
SHA1 01d97a5a2441e16512c5d72e70ea1b4600372069
SHA512 94358059cd635b662a8601a42d6771d6107aa74ea5b6c0747cdba941b42cbe8d2ce509afef05f7db9e7c760358972693ebe28c4e8c17e817877bfbefc46a2913
SSDEEP 3072:LAmxBw9mYXcxUqjVPf5Q9xl7opT44aJNwo5NEFfAHeQ:i0Cd
TLSH
T147F32496891F48FB24138B97C379AC7445A6254E475E4A1933CFC2AEB241907CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 95c01c1f55257716467a503e728c9fa05308b2094cf64c0d5154f56bfdb9de01
MD5 46552de19b224c6c29b98dd310f46cd8
SHA1 df23bb8643ce1a7ef245078c42a1d53908444991
SHA512 29bd8fdda88ce30e65d9fd3145f4f56a26c01da5fb1d1ef78bbaad8254050db4b3f4cb5457677c71095b3d2154b43f04a4f14443d2eac99405dac7c617149626
SSDEEP 3072:LAmxBw9mYXcxUqjVPf5Q9xl7opT44aJNwo5NEFfAHeF:i0C+
TLSH
T123F32496851F48FB24138B97C379AC7445A6264E475E4A1933CFC2AEB241907CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 14021434988d266147c5799ef7dc7ec379fa668b7c06c3a9076ab548a333eb2a
MD5 c952bf02e6d95f6ecdba0c9788651248
SHA1 f6646616182b77314f6920876104d51158262c16
SHA512 ab8f1efb6a8e6d4e1b6fec9b85243ab8886258aa599548341d7638993f513e6017aad58190cc200def79615a47243031a42f922694ceff4fdd24a3c3ad1a7a39
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtYA+wGX:26F0eMpAAYEhpVhwo
TLSH
T151456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 6694a50ea7c480ad188e020cdacc10f75851982ad7ec273b1661e4c3b5ad0758
MD5 1ced0b0b70d6df1101afa5e0ea317c3b
SHA1 f360838ae3312316306d4d58cb3cd493f709dbac
SHA512 dd69220ae4b8cffc1fa7f65a529e10edad918e47005349335dee81274a7136184594ca490bd02f8dedf3949bc5ac6606c0295b1df5796959270614f23ad1465b
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeYA+wja:V6F0eMpAAYEhpkhwu
TLSH
T141456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4204-267-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads