1d8e0f6045d6e90a9ace3df9bfff92ff2758596f89c1a81c3f729e865a5705d0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9f51dd2d3a0d81b439a39f254d85f92f_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.5MB
Sample260808-ffxwestwe1
SHA256 1d8e0f6045d6e90a9ace3df9bfff92ff2758596f89c1a81c3f729e865a5705d0
MD5 9f51dd2d3a0d81b439a39f254d85f92f
SHA1 f931ef41f2f1072c23bbb4b6bebdd266746def5f
SHA512 124ef20ceaefd287f39e98bd2f3f9907d992bfccf39ad66a055536310ae00f7fa43e49dab6ac406feb081a837af960af8ea684a9d4405b8d884fd0e3bee491f1
SSDEEP 49152:2oa1taC070USRtlE3pFdM28bl/Zm7h6KiJNJrV:2oa1taC0MRtlE5Mtl/ZVNJ
TLSH
T102C5D063E7818AE8E68D04766F148241D62EF621A70F6712799C131DCF4778B8F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3184	4E26.tmp

Executes dropped EXE 1 IoCs

pid	Process
3184	4E26.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_9f51dd2d3a0d81b439a39f254d85f92f_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E26.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3184	1152	2026-08-08_9f51dd2d3a0d81b439a39f254d85f92f_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9f51dd2d3a0d81b439a39f254d85f92f_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9f51dd2d3a0d81b439a39f254d85f92f_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\4E26.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E26.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-08_9f51dd2d3a0d81b439a39f254d85f92f_amadey_elex_glassworm_njrat_smoke-loader.exe EA75DE61E1E0606E3BDF20881D1AAB7F463DB3D4F1E2A319017B85BCF3BCDFE57A3FA89B4CD0B876F8455F6090F5CDDBFA5C74BEB03087223C3191FDD7A95596
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E26.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E26.tmp
Size 2.5MB
SHA256 74578b413d2fdb265e4d965d34ad465ffa66ce5a2ab4deed6c95557dbc5e843a
MD5 28542de44e52a19c54a32a4c34b2040e
SHA1 4e8efb70a19bd386941338bd6c80b773c5c97178
SHA512 b89e0f37cf921bff3d66b2ba57ff434e2b44e3ecb68e3fc4b87c150f934e0d9e50710920139da9450f604b0b9ff3165d0dbfe5478d833cc51f3808e3ac6cbc24
SSDEEP 49152:2oa1taC070Ujqq3wX3oYy5TaxVGABte+C5V:2oa1taC0pqB3oDbABtv
TLSH
T1A0C5DF63E7918AE8E68D04766F148241D62EF231A70F6752799C120DCF837878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download