0bde28a34cf1cc502c5b2cf163937d2cd923c812c66e7588cc8e424e8763cc34

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260814-x3mgmsgm3t
SHA256 0bde28a34cf1cc502c5b2cf163937d2cd923c812c66e7588cc8e424e8763cc34
MD5 71b23d9ff58ecf3d86d759c6ffc3e1c0
SHA1 673268544f334838851c51da394af9c1c528cd1a
SHA512 95b35f8dc609b98aa9506ae0a5a767aa566147542b6eb77a911d7ea8bfdec2a540a7a7b400e30f5bf038e982ee8b4157da1463be0779737f3923a80b21ec2400
SSDEEP 98304:p0nAAYEpPhb9OU/jIEeQfoR/IuOFVjUu5t:uN/9FIF0wuf
TLSH
T13CF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
244	original_temp.exe
4332	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4332	original_temp.exe
4332	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 244	4076	2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 244 wrote to memory of 4332	244	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_71b23d9ff58ecf3d86d759c6ffc3e1c0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\jds240712531.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240712531.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXF991.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF991.tmp
Size 1.1MB
SHA256 5f7bc215c8fb1ae264fc2899d0e0096f776afce66b5087f4e06efd87999269d2
MD5 5013d0857111029c3e1fb39a1edaeac3
SHA1 3c8ed374d0e9226eaecd6199f065b8fc2e6475f3
SHA512 727b78d090ad70ec22eb9b21cfdd161b4e849170ac28e229509b729495dae7efee4d3b621dbb70120f78757052a9fc9800f5263c28c8cb9ebeb1035d4bb6e4fc
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+whW:G6F0eMpAAYEhpyhws
TLSH
T17A456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240712531.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 a76121134d15370746cf4388413d56e9c3517fddb8ab9a614b4a0db4dab28e51
MD5 a19e8004b156c5c596cb1892f6846bed
SHA1 e1388556af37ab200123efb54eed4493aaa76da6
SHA512 89d5c5838bec4046acecf95128135c5a50a618d8656efc084d67a84b070554dc41d639333b2635158cb1bd05d4ffe61066661aa6b72ef0499b74bcf56e087748
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBg:qosF
TLSH
T153F343CA956FC5BA30234E83C77A6C754592355A835E0A2C62CFC2DF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 169KB
SHA256 7e91242af96d8d32edd7d707c4c22dd1c6addcdd703944ed1e56d486da63f581
MD5 9327084faed8038234fc39045c02498f
SHA1 8cbe159e5c4d0e5f1a853759a66b500db1181d6e
SHA512 75615674ef6c28f876b553a96d0ac6fc4acf044f5d51cecb7b4db6907b4e31914bbb1807fb97ce66d2fc9863f4278fe4efc0ddd281d3a76faddc286bfb05591d
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBL9Z:qoso
TLSH
T1B70453CA856FC5BA30234E93C77A6C758592255A835E0A1C62CFC2DF7645903CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 fe23469801e359c030cf9932595e779247b2d667d04d13b5105459158e6edf9d
MD5 790f1cc6a5f04d9da22951eb7cf19c78
SHA1 a469b60e8bc05f3d7fe03e9b1a56c2b4ad6f555f
SHA512 b1dedb65db460db0c60e5c6182ce33b7d69c0e09b78c8ee6b7ca481f9730aeb0dd8deb34f66d13ffa8b45a42c9702ec07ccb96791a8ab583172dd25f5cea57de
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjYA+wkD:G6F0eMpAAYEhpPhwK
TLSH
T1CF456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a11c5a2c07b52e474af41e405391085cd1d7788b91bbf8b31662992c9f811e76
MD5 8d12ce1c7ac1d70818639d4f063ebf9c
SHA1 09d0802f4a0526617e2780c353fe98a5b4291459
SHA512 877502235b070c32787390bc33cc7a1ae19e461d25098516754b817666b85cf65228d8eee4f2a5ebce20b628d8d433bd275db8bd952a9906dafb6f747043814c
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfYA+wR9:m6F0eMpAAYEhp3hwr
TLSH
T1E0456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 785ae38b5589edf7a4085c638813cceb88399c3ac5e6bd7d4a073228a6fd6958
MD5 78fc0ef54210c1c377e5a0b9b88aa6df
SHA1 b5143d8c4e36c65d583ddf9636936fd519ab9815
SHA512 f7501a62b8d4e92e7092645db96b490dfc762b4c37d1c7a76539998c693249aaee7d300dfd17abe6140b5d9b314f9afd74859b78fa5bd56d6f43024158de86ac
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wh+:V6F0eMpAAYEhp9hw0
TLSH
T19B456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4076-264-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads