0bde28a34cf1cc502c5b2cf163937d2cd923c812c66e7588cc8e424e8763cc34

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260814-x3mgmsgm3t
SHA256 0bde28a34cf1cc502c5b2cf163937d2cd923c812c66e7588cc8e424e8763cc34
MD5 71b23d9ff58ecf3d86d759c6ffc3e1c0
SHA1 673268544f334838851c51da394af9c1c528cd1a
SHA512 95b35f8dc609b98aa9506ae0a5a767aa566147542b6eb77a911d7ea8bfdec2a540a7a7b400e30f5bf038e982ee8b4157da1463be0779737f3923a80b21ec2400
SSDEEP 98304:p0nAAYEpPhb9OU/jIEeQfoR/IuOFVjUu5t:uN/9FIF0wuf
TLSH
T13CF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
988	original_temp.exe
1964	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	original_temp.exe
1964	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 988	3908	2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	87
PID 988 wrote to memory of 1964	988	original_temp.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\jds240666031.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240666031.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 8bb8f2e87df59a46e0788e6534152feaffd91fc04878358a46a9b6004a2e4a41
MD5 723ab3f2b0c0241474d147f91d0053d7
SHA1 2afdc88984b4ecaa70781c32102301a890f140d6
SHA512 abea1ad26590a836d0d81e56eb271ed855a55a690d784b3d323a8e0200a3dfe5eae6ba42d121e4ddde11734a9c7885515f50ca546c89c9a30be8929cec5e5884
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIYA+wkb83npi63it:e6F0eMpAAYEhp2hwC8XpiMc
TLSH
T1AF757B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4159.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4159.tmp
Size 1.1MB
SHA256 fe23469801e359c030cf9932595e779247b2d667d04d13b5105459158e6edf9d
MD5 790f1cc6a5f04d9da22951eb7cf19c78
SHA1 a469b60e8bc05f3d7fe03e9b1a56c2b4ad6f555f
SHA512 b1dedb65db460db0c60e5c6182ce33b7d69c0e09b78c8ee6b7ca481f9730aeb0dd8deb34f66d13ffa8b45a42c9702ec07ccb96791a8ab583172dd25f5cea57de
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjYA+wkD:G6F0eMpAAYEhpPhwK
TLSH
T1CF456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX441B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX441B.tmp
Size 1.1MB
SHA256 785ae38b5589edf7a4085c638813cceb88399c3ac5e6bd7d4a073228a6fd6958
MD5 78fc0ef54210c1c377e5a0b9b88aa6df
SHA1 b5143d8c4e36c65d583ddf9636936fd519ab9815
SHA512 f7501a62b8d4e92e7092645db96b490dfc762b4c37d1c7a76539998c693249aaee7d300dfd17abe6140b5d9b314f9afd74859b78fa5bd56d6f43024158de86ac
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wh+:V6F0eMpAAYEhp9hw0
TLSH
T19B456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX441C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX441C.tmp
Size 1.1MB
SHA256 16d6990c5c6502e5a959b36980daeeee24c3b7ec5883523c1336b49db68bd874
MD5 dcc64066da4041aa87bbab9dde928d5b
SHA1 33fb71746dfb8396b29c45a8ae0c4b615f73a7b0
SHA512 3ad34b0e10ee1a5cf23618c2f138257be41839d261524f85895ecce8af72d806aa7c6fd8c120b93dafaabd52665199793aa895ad8cd3658e3ad8eaf3b63f6aa4
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtYA+wkr:66F0eMpAAYEhpFhwy
TLSH
T105456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX459F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX459F.tmp
Size 1.1MB
SHA256 5f7bc215c8fb1ae264fc2899d0e0096f776afce66b5087f4e06efd87999269d2
MD5 5013d0857111029c3e1fb39a1edaeac3
SHA1 3c8ed374d0e9226eaecd6199f065b8fc2e6475f3
SHA512 727b78d090ad70ec22eb9b21cfdd161b4e849170ac28e229509b729495dae7efee4d3b621dbb70120f78757052a9fc9800f5263c28c8cb9ebeb1035d4bb6e4fc
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+whW:G6F0eMpAAYEhpyhws
TLSH
T17A456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240666031.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 2289e397af1227ddfaec7b314573d853316fd1cd53c2139131392120d8400c88
MD5 488b11b0e76b45d654f9fa6ffdeb6bd5
SHA1 4b78b3f1c1c337e0c3a9a159c8e5799c7341ffdd
SHA512 969ed0e92c3170d16a878c8cee77014effa9123d68da921ed3bd707091606eaac6c5da23b752a35f5d7848569f19633735467cd1ac7f61ef74d308260b7f2028
SSDEEP 3072:q0Gr8nZoV59XTtSohUBWYFXenGsVsKttTV0kqOf8R10EmiFBuG7VqWaQG7VIBXaF:q0GXyEEmiFBuG7VqWaQG7VIBXaQCqaQK
TLSH
T1F7F3228A892D89FB34634AD7D36A5C549E921509479E092C36EFC2CE6845D03C73E8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 e740ec95a7e543b7f0a9ed5a962a6fa31871d7df800b7ce2e8bd24e48c69742e
MD5 1c029cb302d622ec0ed6d5c935bc3b0e
SHA1 fb467830ac71b83be696dbabf1d2a0ecfb1b9412
SHA512 b538baea52c4e3a27dfe9b7f9dd80bddf27ef0897051005f47bfc789ed0d358632fd18593ce2ace98499007beff09bcd939c5c912126178baa6104db7e33632c
SSDEEP 3072:q0Gr8nZoV59XTtSohUBWYFXenGsVsKttTV0kqOf8R10EmiFBuG7VqWaQG7VIBXaF:q0GXyEEmiFBuG7VqWaQG7VIBXaQCqaQs
TLSH
T196F3138A852D89FB34634AD7D36A5C549EA21509479E092C36EFC2CE6845D03C73E8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3908-420-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads