20e1cc51b96b0be0d47fd3738274f5fbe0c0e7505d9adbdc68f1bfdfffd86b5e

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.6MB
Sample260810-ca7a5ayfme
SHA256 20e1cc51b96b0be0d47fd3738274f5fbe0c0e7505d9adbdc68f1bfdfffd86b5e
MD5 d2eae56c6e7eaad6971b9147ee438017
SHA1 e2bdeee2a309f3e648a75c26cdcc7c4516b300af
SHA512 a4a92898bc6573899856dd214db9ce3c51ceecfa3cbe580a8e7512ef3cdd53978da2f6183ac999c95178a315d369c932af9e7cdbab72acfa41f9e6a1a42b5deb
SSDEEP 98304:/0nAAYEpG+hO9OU/jIEeQfoR/IuOFVjUu5w:8Nkj9FIF0wuK
TLSH
T13F06AF91FEC2A071F4B30571286AD37D9532BD25453288AFB3CEFA196F319815A36B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1064	original_temp.exe
3524	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3524	original_temp.exe
3524	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1064	3448	2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 1064 wrote to memory of 3524	1064	original_temp.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d2eae56c6e7eaad6971b9147ee438017_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Users\Admin\AppData\Local\Temp\jds240751593.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240751593.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX917C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX917C.tmp
Size 1.4MB
SHA256 b20adf05cf173c29cf514b721e29d3887d8aa29d1ca6d8aeebc4685477568593
MD5 eb1a65d9d6c69c8fb530ffea31c2b464
SHA1 35f51bf4fd22acc2d1e6cde11db84e9e842780de
SHA512 2097bff74a6a9643d6d85df55aeb665f366480983ff8d345d62c83987b1abe63139ec8f433d06c52b8088dc6d369d48228e8e406cddbd476399b6e2b72e4a7a1
SSDEEP 24576:P7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOK1YA+wGr:06F0eMpAAYEhpv+hwk
TLSH
T183655CD5EF83B4F5E95308F1340BEBBEA5236D2980328D27FA87FF11B5729522529502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240751593.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 77d9f6c030a0178dde8c7d49da9c21732c174633f4dfdb0f6b8b64d56aada3d4
MD5 f4712b2188ed1120eb836a169e7d5c1e
SHA1 a81906c592cb22a03e3d5088b0ed0d0f22d9c874
SHA512 06f5286f242e40ef29f62bf342d43a5d83837a38655cc9716cdb3c41ed9c286f379e2ee1ea722b2540fef2b9e12ba5a3794c9811bdd6ee029f8351ed0f6c6c98
SSDEEP 3072:5sHJ67RD5ScpA6lVnRJ8rPIKYA2vvdK7jf8vajStCPh:szwY
TLSH
T1C7F35386856D45BB34534BD3D7AA6C684A660549436E0B2C72CFD2FE6444E03CF2E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 6a76865488b2c75c88177b70c2afebde93ebb653d212a9038798a76838add351
MD5 9825c4adc85a8ac3453efe775d6fdd2e
SHA1 86c92c6164c0d949588a25046c601a8addaea982
SHA512 2cf8d645b675a6a8521b6bb03ebac32ee791637f2686417a0ede69467533f4a940b030f0e0cd5d658d19372a7b93b83719130173d6f4630c8eee94d7af52390a
SSDEEP 3072:5sHJ67RD5ScpA6lVnRJ8rPIKYA2vvdK7jf8vajStCPt:szwC
TLSH
T1A7F35386856D45BB34534BD3DBAA6C684A660549436E0B2C71CFD2FE6444E03CF2E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 1bde299645097c299b773a9f7153d6bee420a41164deb5982ea577ce900a07e0
MD5 925521d5f63e5970ccd6151df5bdb611
SHA1 7e13f42880d85f5fa720019bd205ca28fcd30819
SHA512 9853133218943e958130db533b6cfe2a6eb9eb3f736026b989bb9fadb72781da3d0548a17711013d2f8ccc9788c170518dff4817c72eef0bcc8aecf8b97c1694
SSDEEP 24576:f7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOH1YA+wUO:k6F0eMpAAYEhpG+hwb
TLSH
T117655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 028e6c5645df5b6d6fa8046308e4f960723ce3a863f79ccf2a3a35c38e01a09f
MD5 c3b8ab2f16db91bb6aa2293f2cad296e
SHA1 dff48bfa4aebf078cc4290f2f3ff25aaf7827ec1
SHA512 08e1bd5e713b01afa04342c4760c1517f8ff20a00afeec1b4637d978458256b49314fa148f019acddac667dd68e0aa2e40fa49535bd37e28f9652b9630c3bf1a
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOI1YA+wJI:A6F0eMpAAYEhpB+hw+
TLSH
T1EB655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 33666be53ed340a9b2932d2e4467790d6a5ef9a5d5d9fef884d8e10db4c3cc12
MD5 9761627f26cd371255a92c5725631fd7
SHA1 44f2bb8f56fe184fb69d106f3c5ed5624f9e2649
SHA512 e0ee5d3f3e149e11d8a0f90755401c7a4a506d425331311e960a69eb60a78e92ba5084233001a57806b51c7d5ba4a7e65dabb1b329ac394c856fcc2d83d28ade
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOw1YA+wWS:46F0eMpAAYEhpt+hwl
TLSH
T104655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 25918d9d14858e3e130b9069a168eae5efdc029e5f7f0f5529bc882a055f21db
MD5 7080746b3d94f6e1f09d4e071bdb6131
SHA1 e789af3dd455e58dcb12f437da097219e32d5c35
SHA512 f0eb8e72c2d332b77f7f0628057e0ab60091fd03290786cc6bac285f5e142d6d7def3b9400059afa1318688f7778cc7f79a2d3fb57c99178b5dcbf4ea3d01170
SSDEEP 24576:f7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOt1YA+wGD:k6F0eMpAAYEhps+hwc
TLSH
T10E655CD5EF83B4F5E95308F1350BEBBEA5236D2980328D27FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-266-0x0000000000400000-0x0000000000571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads