f322d7032e3549d66d14c2dcee717d172a78e56f8cd3046bc4f9ea7a3825249b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260816-zefejaak21
SHA256 f322d7032e3549d66d14c2dcee717d172a78e56f8cd3046bc4f9ea7a3825249b
MD5 9edb0184fdc07199e3bd3d1cdb81f1fe
SHA1 226f3208cf686e67a023f27fa3a38387e0769e79
SHA512 ad6eff8861dc53b5ffd0326fb1fc788d1d48f92a378d5b877141c933ec1b61177971122be5d663c0357db4443895a5ad253d6484d1491cabbdd4c4d72824aa46
SSDEEP 49152:aWaTIqGhMeaDOegyqu3MJA/y2AiEP0OXFz9wvJpGVb:haTIvhMeaiego3MJA/y2CPVrwvJpG
TLSH
T15D16AC71664057E2F0A133779AA7F67A392AD930D32449FB62703CA897200D7F72BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dcBksc.exe	2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2680	5dcBksc.exe
476	5dcBksc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5228	5244	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5dcBksc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5dcBksc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
476	5dcBksc.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe
5244	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3836	3472	2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 3836 wrote to memory of 2680	3836	2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 2680 wrote to memory of 476	2680	5dcBksc.exe	92
PID 476 wrote to memory of 5244	476	5dcBksc.exe	93
PID 476 wrote to memory of 5244	476	5dcBksc.exe	93
PID 476 wrote to memory of 5244	476	5dcBksc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dcBksc.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dcBksc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dcBksc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dcBksc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9edb0184fdc07199e3bd3d1cdb81f1fe_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:476
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 796
        6⤵
        Program crash
        
        PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5244 -ip 5244
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5dcBksc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dcBksc.exe
Size 3.4MB
SHA256 fd0e8376b15cbaa408a04ee179371f33f99c41fa57222a22c193dc6d0153f82d
MD5 24bc3c18bf3a53e5b635fee27f02c809
SHA1 f84efe8d5e9bad04121389920011be744877752c
SHA512 e000706e5116681ec22bf6f44643c476a439084684bb7340bd685187a52fdfd864e4b7b18921d59da5cf3982a3b28181317080962c88185c49d73ecea02383c1
SSDEEP 24576:muq9BKSDYyxsk0DdNu1r9VaYoh5nWSEq9aMDNjlx+6hmzSsqFLsyBkA7UI:muq9BKSDpoq1rS5ZxlxB50R
TLSH
T199F5DE8752A8579DF1FF2B6EBAAD75436252AC1F434E12522F80814B63FB481F930376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-25-0x00000000773C8000-0x00000000773C9000-memory.dmp

Download

memory/476-22-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/476-32-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/476-30-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/476-27-0x00000000773C8000-0x00000000773C9000-memory.dmp

Download

memory/476-26-0x00000000773C8000-0x00000000773C9000-memory.dmp

Download

memory/476-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/476-18-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/476-19-0x00000000773C8000-0x00000000773C9000-memory.dmp

Download

memory/476-23-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/476-24-0x00000000773C8000-0x00000000773C9000-memory.dmp

Download

memory/476-20-0x00000000773C8000-0x00000000773C9000-memory.dmp

Download

memory/2680-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2680-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3472-2-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3472-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3836-15-0x00000000026A0000-0x000000000273E000-memory.dmp

Download

memory/3836-14-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3836-1-0x00000000026A0000-0x000000000273E000-memory.dmp

Download

memory/5244-28-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Download

memory/5244-31-0x0000000001490000-0x000000000152E000-memory.dmp

Download

memory/5244-34-0x0000000001490000-0x000000000152E000-memory.dmp

Download