fe5f3dec8d88d472531332f627abee06652f3e81d63202486e9b141f3c85e9c2

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_ec1a9dd257ae5f4c7fbdb8373b4c9d87_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 3.9MB
Sample260815-3rx2wswwet
SHA256 fe5f3dec8d88d472531332f627abee06652f3e81d63202486e9b141f3c85e9c2
MD5 ec1a9dd257ae5f4c7fbdb8373b4c9d87
SHA1 961ff043040fe23e71dab2c0b90977b2e9b10699
SHA512 47d2b01ebdf2a869dd4d62f76b8f8d5901375aaa8b246dd2a4b5d012f7c2fe4f1e121f340964bd2b04ba987c01528757172b011c278272d33db227c389d35a88
SSDEEP 49152:Moa1taC070UUmjLerbBdX3v3QHRJWdL1amL1VmgbQIzZMPXpB91rHpn:Moa1taC0Lv4PHv3QHXWHamwnLrHp
TLSH
T169168B57EB814AE9E38D0436EF548150972AF22997FF1261746C020DEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2660	6FA8.tmp

Executes dropped EXE 1 IoCs

pid	Process
2660	6FA8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_ec1a9dd257ae5f4c7fbdb8373b4c9d87_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6FA8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2660	552	2026-08-15_ec1a9dd257ae5f4c7fbdb8373b4c9d87_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_ec1a9dd257ae5f4c7fbdb8373b4c9d87_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_ec1a9dd257ae5f4c7fbdb8373b4c9d87_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\6FA8.tmp
  "C:\Users\Admin\AppData\Local\Temp\6FA8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-15_ec1a9dd257ae5f4c7fbdb8373b4c9d87_amadey_elex_glassworm_njrat_smoke-loader.exe FF10B9EDB5E57CBBD7B0D388E3941B5876FF7B0AFB4A9ADD7B32A81270215E5AC79EAED2BC4701E59EA7DF60AAAFC825AE32AA91F466037CCF060B909AAC4D39
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6FA8.tmp

Path C:\Users\Admin\AppData\Local\Temp\6FA8.tmp
Size 3.9MB
SHA256 efc5c8153164ffeb6469c8ace5b3859dba56e3a236c4f9123eb0178529232537
MD5 3699c9fb0e965722fa30e68829b43411
SHA1 b6b21d0ddee6f55e4075a8dbd92b841e8aedd6fe
SHA512 ec38a3ad7ab776ec44d749e58687fab819951d5a14751b2344df74470eff7da7105196241530d72c7a49c93baefb116787a61f92fc35571bd467f9b763abbaf3
SSDEEP 49152:Moa1taC070U7LxDhfNuLFZoXXy3/VmgbQIzZMPXpB91rHpn:Moa1taC0VwhZoHy2nLrHp
TLSH
T123168B57EB814AE9E38D0836EF548150D72AF22997FF12617458420CEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download