7411381bd957343b67357a70e49131c79266993a8d1e1910aaaa8b9b5b2122a9

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_4ed69b4eb30602edbe2f25b62ed0f865_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260810-c5k2dahp4x
SHA256 7411381bd957343b67357a70e49131c79266993a8d1e1910aaaa8b9b5b2122a9
MD5 4ed69b4eb30602edbe2f25b62ed0f865
SHA1 edc30ad1e26827fb91d681917dd4088a4d12708c
SHA512 7e3ef9108054ea9725ee9dd82946d55dee8420317fe8ca3ec5c2b346dbe499680dfcbd3d6a68f39ba4b4e1f9b1b0f0b2db521fa4b3428333e2da8e99976479cb
SSDEEP 98304:J0nAAYEpRhZ9OU/jIEeQfoR/IuOFVjUu5t:ONX9FIF0wuf
TLSH
T1C2F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2996	original_temp.exe
6020	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_4ed69b4eb30602edbe2f25b62ed0f865_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6020	original_temp.exe
6020	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 2996	4204	2026-08-10_4ed69b4eb30602edbe2f25b62ed0f865_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2996 wrote to memory of 6020	2996	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-10_4ed69b4eb30602edbe2f25b62ed0f865_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4ed69b4eb30602edbe2f25b62ed0f865_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\jds240735687.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240735687.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5492.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5492.tmp
Size 1.1MB
SHA256 2cd4cd105da22c2b67e8719b12f0f424312fb7595088b7e6319b17e8bd368e68
MD5 b6be1028dcd5d5f3fc278858e72b26c8
SHA1 d05554920bcc774e7165b48c72607096ff6597bb
SHA512 d8980e6f652109f6373c0e797f2fcbd8fe05d556eaa85e04db9ab697f2533fdb5645626bbb3a9bfbd77a2ae3240ff58b39fb948e6f7f537ff71c951ce876c910
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+wy6:y6F0eMpAAYEhpohwF
TLSH
T11A456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240735687.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 9871d9e09306ae50a147e837384bc688b378b5224a5ddc411cbefcdf6faaeaa2
MD5 c6ab2f176fa40a360ae8372cd42035cf
SHA1 1618a57db591c84dd52e2888a12602ab913a9b49
SHA512 f128f86337c8a576bf161747b7acbeb9bccac2cb0fcd13b5cb523d151cfafef53471de622fc440748429c6a3b5cc94a35879a2ea8957581c2f55227828edb7ad
SSDEEP 3072:LAmxBw9mYXcxUqjVPf5Q9xl7opT44aJNwo5NEFfAHeB:i0CA
TLSH
T1F8F32496891F48FB24138B97C379AC7445A6254E475E4A1933CFC2AEB241907CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 f7a39790f80dc4a346399c92d99e322db5ea2a9fa859089e2e8d64331900efc6
MD5 85bc4317d572326e29565675109db849
SHA1 9993ea6cc11ba868067d3f433583501fe5a87096
SHA512 cd4c9f7fa0c63fde6498f640963baf9bb277a108fab30ea9f00a3f8bd0f88ce50162d1efebff0dff51197928565fe27bfec27dcfb45331ded26145c05e2ee5b0
SSDEEP 3072:LAmxBw9mYXcxUqjVPf5Q9xl7opT44aJNwo5NEFfAHes:i0Cz
TLSH
T118F32496891F48FB24138B97C379AC7445A6264E475E491933CFC2AEB241907CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 27bd77a5863df63c06c06a5fa78b6525c3bd386da1ec7b8b20c617ac5645e5e5
MD5 f0e499ccb4447d416888d60528bb7230
SHA1 04706ee36b96a547a90668509e61e78c8b58d6a8
SHA512 fddd414cdd71c92cdd87f67326c7f3268d58aac84940498e35ef3fdd7619f6c5873fa31fc94bb8bfcfe43caa564e92dae526789ff82534513acf51455f27e288
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONYA+wgF:m6F0eMpAAYEhpRhw8
TLSH
T140456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 46683873eea0cd5a28462ae824df487b6e3f5c164d07703946214dcbb999b640
MD5 cf017baff5cb2f5ed305d3ad5cd9adaf
SHA1 4099f555e4956a56fdae1e7b708483dcd0836708
SHA512 b8d7318abd28ca72e4eea40305c79e3620da9582368bea28aeba07a8913b32f64909a05e0cdef07e648a249346cb3341077223df9fbd8128a2ee8aaab75060f5
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfYA+wlP:W6F0eMpAAYEhpXhwR
TLSH
T190456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 e7306140d42bcfbe55ee89894be0e604f8e92c1581e462d5ee41217ca8a4c899
MD5 490f6379a2683a8de9084d7f1f307ba0
SHA1 82695341e2a20e4717791aaa71416ae5d886e71f
SHA512 8b5b2410148ea10372f0d5be541d27138c1216e445e8b40dc20a2e33649742b07e2398145d05731f32d7264e7e3a54a912d41198c05782cc7b5e325d54421977
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+wLR:m6F0eMpAAYEhpOhwV
TLSH
T15C456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 40ac351b78a59298789b5d99a67df81d6992d26efb278615896e416eb04c984d
MD5 b6bf97b7b245bdbbfe98ac57f5bba319
SHA1 f621a684e741dad618fe6c8fb1f2e0b5ae8638d3
SHA512 4c67fe3c8ffe08ce6b4ae48d2c41555d8aaf12ef65bc2e93d50aba3ee4bdd8f71df10d817b7494fe63c6f4bc61677bdf7e81c730e83f6a18a106002926622b60
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODYA+wyC:26F0eMpAAYEhp3hwN
TLSH
T101456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4204-308-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads