Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 03:58
General
- Target 2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
- Size 6.7MB
- Sample260810-ejrm5s1ape
- SHA256 ef5ff11122dc28b57dd7c42c92660feb459d02bd23b5c652400d09375a4db3f4
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 33 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\49277B4CF6491F116AF82CFAFD44B480\2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Windows\temp\49277B4CF6491F116AF82CFAFD44B480\2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8B9F6E4CF6491F116AF82CFAFD44B480\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\8B9F6E4CF6491F116AF82CFAFD44B480\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAAGM2uIn2bcUcPWwc4b5ScrAvAAAEQL//++Yq3WMAh3sS8AGQAHAEMAdQBmAGUAcgB4AHcAbgAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQA1ADkAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
2026-08-10_d1d667af4167948da2af84d8e8fb92ef_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
memory/240-1-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/240-2-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/240-0-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/2884-4-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/2884-5-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/2884-6-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/4604-44-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/4604-51-0x00000000058D0000-0x0000000005920000-memory.dmp
memory/4604-102-0x00000000068E0000-0x0000000006906000-memory.dmp
memory/4604-106-0x00000000069D0000-0x0000000006A84000-memory.dmp
memory/4604-97-0x0000000006C90000-0x000000000724A000-memory.dmp
memory/4604-96-0x0000000005FF0000-0x0000000006056000-memory.dmp
memory/4604-116-0x0000000007E50000-0x0000000007E98000-memory.dmp
memory/4604-95-0x0000000006320000-0x00000000066C8000-memory.dmp
memory/4604-120-0x0000000007EC0000-0x0000000007ED6000-memory.dmp
memory/4604-91-0x0000000005C50000-0x0000000005C66000-memory.dmp
memory/4604-87-0x0000000005AC0000-0x0000000005B28000-memory.dmp
memory/4604-128-0x0000000007F00000-0x0000000007F1C000-memory.dmp
memory/4604-124-0x0000000007EA0000-0x0000000007EB0000-memory.dmp
memory/4604-98-0x0000000006710000-0x000000000674E000-memory.dmp
memory/4604-45-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/4604-132-0x0000000007F60000-0x0000000007F94000-memory.dmp
memory/4604-41-0x00000000053B0000-0x00000000053BE000-memory.dmp
memory/4604-140-0x0000000007F20000-0x0000000007F40000-memory.dmp
memory/4604-136-0x0000000008060000-0x0000000008114000-memory.dmp
memory/4604-141-0x000000000C270000-0x000000000C302000-memory.dmp
memory/4604-38-0x0000000073122000-0x0000000073123000-memory.dmp
memory/4604-145-0x000000000C310000-0x000000000C370000-memory.dmp
memory/4604-146-0x000000000C250000-0x000000000C258000-memory.dmp
memory/4604-147-0x000000000C3B0000-0x000000000C3BE000-memory.dmp
memory/4604-148-0x0000000073122000-0x0000000073123000-memory.dmp
memory/4604-149-0x00000000005E0000-0x0000000000695000-memory.dmp
memory/4604-150-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/4604-151-0x0000000073110000-0x00000000738CC000-memory.dmp