20e1cc51b96b0be0d47fd3738274f5fbe0c0e7505d9adbdc68f1bfdfffd86b5e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.6MB
Sample260810-ca7a5ayfme
SHA256 20e1cc51b96b0be0d47fd3738274f5fbe0c0e7505d9adbdc68f1bfdfffd86b5e
MD5 d2eae56c6e7eaad6971b9147ee438017
SHA1 e2bdeee2a309f3e648a75c26cdcc7c4516b300af
SHA512 a4a92898bc6573899856dd214db9ce3c51ceecfa3cbe580a8e7512ef3cdd53978da2f6183ac999c95178a315d369c932af9e7cdbab72acfa41f9e6a1a42b5deb
SSDEEP 98304:/0nAAYEpG+hO9OU/jIEeQfoR/IuOFVjUu5w:8Nkj9FIF0wuK
TLSH
T13F06AF91FEC2A071F4B30571286AD37D9532BD25453288AFB3CEFA196F319815A36B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4932	original_temp.exe
612	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
612	original_temp.exe
612	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 4932	2780	2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	87
PID 4932 wrote to memory of 612	4932	original_temp.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\jds240686296.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240686296.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX9100.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9100.tmp
Size 1.4MB
SHA256 1bde299645097c299b773a9f7153d6bee420a41164deb5982ea577ce900a07e0
MD5 925521d5f63e5970ccd6151df5bdb611
SHA1 7e13f42880d85f5fa720019bd205ca28fcd30819
SHA512 9853133218943e958130db533b6cfe2a6eb9eb3f736026b989bb9fadb72781da3d0548a17711013d2f8ccc9788c170518dff4817c72eef0bcc8aecf8b97c1694
SSDEEP 24576:f7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOH1YA+wUO:k6F0eMpAAYEhpG+hwb
TLSH
T117655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9325.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9325.tmp
Size 1.4MB
SHA256 25918d9d14858e3e130b9069a168eae5efdc029e5f7f0f5529bc882a055f21db
MD5 7080746b3d94f6e1f09d4e071bdb6131
SHA1 e789af3dd455e58dcb12f437da097219e32d5c35
SHA512 f0eb8e72c2d332b77f7f0628057e0ab60091fd03290786cc6bac285f5e142d6d7def3b9400059afa1318688f7778cc7f79a2d3fb57c99178b5dcbf4ea3d01170
SSDEEP 24576:f7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOt1YA+wGD:k6F0eMpAAYEhps+hwc
TLSH
T10E655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9355.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9355.tmp
Size 1.4MB
SHA256 d62bff3162819a929a2c2ef8640445a6ba5aa5ebb033fc8def6365c964c7409c
MD5 01638f638af82ed42e18ce757e9cd355
SHA1 99e3251837e77928691916459f7929b01dd744c4
SHA512 e141c832e350d3069429a1d2149d2a84fa057da1343ab86dacfab8b069b7db21555f2511f0fdad19680e68291c06da5ca55fc4b98681e7608ee13e07a7b00802
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsON1YA+wUW:86F0eMpAAYEhpI+hwj
TLSH
T1DE655CD5EF83B4F5E95308F1340BEBBEA5236D2980328D27FA87FF11B5729522529502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240686296.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 870b2153d003aa74e7c236d7289cff3b660ec3cbf1a3af830bcd0dd4c4f7a114
MD5 d0fcc08259ccb93dfa722c30e090d022
SHA1 2db184af60fcc1ee7603e2f619879ac5159f6275
SHA512 d27428d4395b411ac465054ee910aa0926ed4b1becce2acc0c7da27a3bb988e646114e1df6ffa2c44a7159a77384479c7129e5fa2a4e0c96ad80b3d4528ff7d4
SSDEEP 3072:fIdJiXdPNPCuOccgHOBgSFNgLIGlCo33F4fUwYdHIgi2+8D:tOcijWj
TLSH
T1EBF31F8A991EC5BB24630BD7C3B96D648EA3150D475E092831DFA2DA7942D03C63E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 53d9b6dc9f610273cde99f0c8f2fef06b39ed7b1aa1c12d96ce3a21e1afd9a08
MD5 47ea508120617543a4cfbb5b2ee102af
SHA1 7d061a19c64edf8385e2a9ccfba9e787ff7fbbbe
SHA512 8607256e7eb8365b7ca848eeba5524c1fddf5ffdfa37b1347ec82de0285f13d5c8740d2f83f181a12a2e3343d8d0448ef687695b5b606c2ae42071e8e6c6f366
SSDEEP 3072:fIdJiXdPNPCuOccgHOBgSFNgLIGlCo33F4fUwYdHIgi2+8F:tOcijWl
TLSH
T17BF31F8A991EC5BB24630BD7C3B96D648EA3150D475E092831DFA2DA7942D03C63E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 33666be53ed340a9b2932d2e4467790d6a5ef9a5d5d9fef884d8e10db4c3cc12
MD5 9761627f26cd371255a92c5725631fd7
SHA1 44f2bb8f56fe184fb69d106f3c5ed5624f9e2649
SHA512 e0ee5d3f3e149e11d8a0f90755401c7a4a506d425331311e960a69eb60a78e92ba5084233001a57806b51c7d5ba4a7e65dabb1b329ac394c856fcc2d83d28ade
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOw1YA+wWS:46F0eMpAAYEhpt+hwl
TLSH
T104655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2780-371-0x0000000000400000-0x0000000000571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads