c0fc6ff3c533d68d203cb92c08b15a4720f9fe9a9f0164dbf605466c841b56c4

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
Size 2.7MB
Sample260820-21415azzcs
SHA256 c0fc6ff3c533d68d203cb92c08b15a4720f9fe9a9f0164dbf605466c841b56c4
MD5 f5c42518fc8614943c2dda525020f39c
SHA1 e4fa74ec27ab7b04d0b238f43c0653a57d140c05
SHA512 7c464d55b21dc56d6474bb90de4cbc7a221617da1b97eb4437d7bc4923fa0546d911813872bacacf656ea642b89be0abf541720c27f5263872992e1535ca72e5
SSDEEP 49152:R6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZI:RFVIExNi+2ru6J+yZ78IVG
TLSH
T1CED59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2092	Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 2092	6108	2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Users\Admin\AppData\Local\Temp\SophosSetup-604502523\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\SophosSetup-604502523\Setup.exe
Size 2.0MB
SHA256 0ef0f06d47d3ffd379789e693f3c8341fbbab2fd761e665cc774df145ce51c45
MD5 424b964e84a8555705778e3a366ed327
SHA1 c3407fabe5b2177b49667555db29468c029a0614
SHA512 a75ebacd7b6bd88c77935f8940e22b93c3e5515303853d9819359f0a3cb2808a2d0c9bda0278c9b823c16708ccc12c2ae4ccf6413b49f2419d5d23ed1fb9c1e9
SSDEEP 49152:yFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtTh/:GxNi+2ru6J+yZ78IV/
TLSH
T11DA57D2EBD55C032D96601B0592ACB9BE22CAE35076204CBBFF8793DD5B45C25B33B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download