7ec35ddda381c9f2ad98b157427a6d1a90216d815b8c5ae7ad15b46febbb98cf

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_160ed4991f960e05913ec4a85e2c185f_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 2.5MB
Sample260810-s2lrhacl4t
SHA256 7ec35ddda381c9f2ad98b157427a6d1a90216d815b8c5ae7ad15b46febbb98cf
MD5 160ed4991f960e05913ec4a85e2c185f
SHA1 fe459e5b30e4b2028ea5c2ecca11acc68d80cfbf
SHA512 0cf33fb842f80e0a001620f6d40df5c48223361d716949e65c6df4a4404f7f33941d20a6fc1af6b45287fb185621fb16f4ae9d9ce2dd13f6e2f546fea9f710fd
SSDEEP 49152:coa1taC070U2z2LGoF5h22xiwc9xpPOV:coa1taC00ypbh22xit9xp
TLSH
T1E1C5D0A7E7818AE9E68D04366F518241D62EF631A70F5752799C020DCF837878F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4716	1F56.tmp

Executes dropped EXE 1 IoCs

pid	Process
4716	1F56.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F56.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_160ed4991f960e05913ec4a85e2c185f_amadey_elex_glassworm_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 4716	760	2026-08-10_160ed4991f960e05913ec4a85e2c185f_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_160ed4991f960e05913ec4a85e2c185f_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_160ed4991f960e05913ec4a85e2c185f_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\1F56.tmp
  "C:\Users\Admin\AppData\Local\Temp\1F56.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_160ed4991f960e05913ec4a85e2c185f_amadey_elex_glassworm_njrat_smoke-loader.exe 8EE3C7BF5A9CAC9CF44886F41C61B11E3E8831270A1B033930FC9290D822631FAB71419FE9A8D08A7F9C8AC3A3D6D22D2566EB67CFDC8A42294BDFE0367BEC9C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F56.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F56.tmp
Size 2.5MB
SHA256 06fe150fe8f5b56f84f7bc864bb2fe3d1deba9bb98067dcaf64866c2f789dfe2
MD5 3e3d468caf924d56ee306acbf056cd7a
SHA1 550872e3543bec2c3c4bdf74f09833e6786d9807
SHA512 4a2837aba474c8d65cf317bc419a8df0185c5644dc521f477fc950ac77df72a1536eaac61f8248d0b9b7097bd6a58c2bef40dda6313bd8511c8bd99988793fd9
SSDEEP 49152:coa1taC070US9YbCnu41mwnpw4xASEIJHsaRA8pfV:coa1taC0U9wAHnpwQASJHzA
TLSH
T197C5DF67EB818AE8E68D04766F544241D62EF222A70F5752799C020DCF837CB8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download