Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 14:59
General
- Target 2026-08-09_056c25920f7b13f6d274716bf5361456_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 6.6MB
- Sample260809-sc399agq6w
- SHA256 323af981838216776fbf658d870260578295c3d42644cb3e6b2bc65b2abdce75
Malware Config
Signatures
- Family: Beapy
Beapy is a python worm with crypto mining capabilities.
- Contacts a large (7909) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Loads dropped DLL 29 IoCs
- Domain Trust Discovery 1 TTPs
Attempt gathering information on domain trust relationships.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Permission Groups Discovery: Domain Groups 1 TTPs
Attempt to find domain-level groups and permission settings.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_056c25920f7b13f6d274716bf5361456_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_056c25920f7b13f6d274716bf5361456_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_056c25920f7b13f6d274716bf5361456_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_056c25920f7b13f6d274716bf5361456_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c wmic ntdomain get domainname3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ntdomain get domainname4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net localgroup administrators3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net group "domain admins" /domain3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet group "domain admins" /domain4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
C:\Windows\SysWOW64\netstat.exenetstat -na3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Crypto.Cipher._AES.pyd
Crypto.Cipher._ARC4.pyd
Crypto.Cipher._DES.pyd
Crypto.Cipher._DES3.pyd
Crypto.Hash._MD4.pyd
Crypto.Util.strxor.pyd
_ctypes.pyd
_hashlib.pyd
_mssql.pyd
_multiprocessing.pyd
_socket.pyd
_ssl.pyd
bz2.pyd
ii.exe.manifest
msvcr90.dll
python27.dll
pywintypes27.dll
select.pyd
win32api.pyd
win32event.pyd
__PSScriptPolicyTest_qcoml2zr.b1r.ps1
m2.ps1
memory/1344-70-0x0000000002630000-0x0000000002640000-memory.dmp
memory/1344-47-0x0000000002D00000-0x0000000002DB5000-memory.dmp
memory/1344-43-0x00000000025D0000-0x00000000025DC000-memory.dmp
memory/1344-58-0x0000000002DC0000-0x0000000002E3C000-memory.dmp
memory/1344-87-0x0000000002E50000-0x0000000002E65000-memory.dmp
memory/1344-83-0x0000000002E40000-0x0000000002E50000-memory.dmp
memory/4232-96-0x00000262E9360000-0x00000262E9382000-memory.dmp
memory/4232-98-0x00000262EB540000-0x00000262EB75C000-memory.dmp
memory/4232-100-0x00000262EBA60000-0x00000262EBB60000-memory.dmp
memory/4232-107-0x00000262EB540000-0x00000262EB75C000-memory.dmp