8afe02d4bd65d35eb0ede5ae77cbb61647ff878485b4caf7bd05b26cb74bd98e

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_9f2e980ebae9d8e8ea4c85f2c05cee5f_amadey_elex_glassworm_njrat_smoke-loader.exe
Size 3.9MB
Sample260820-3pht7axepa
SHA256 8afe02d4bd65d35eb0ede5ae77cbb61647ff878485b4caf7bd05b26cb74bd98e
MD5 9f2e980ebae9d8e8ea4c85f2c05cee5f
SHA1 739f5e23d109e98a7fd1a84cb0fd7863b574571d
SHA512 1861f427ead07c5e2257a9e32af87d48574e5b8e7cfb1acb33807d0ba9f8a116a41c1e31dc1d9fbe1ead78f5846f7b98fa51b21d2cce63f004f4430677de060a
SSDEEP 49152:Moa1taC070UTO8N+PrClkRknwgO9YSjde9I8ngpkVmgbQIzZMPXpB91rHpn:Moa1taC0X+PrCiQIYSpiE/nLrHp
TLSH
T10A169C57EB814AD9E38D0836EF548150972AF22997FF1261746C420CEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4112	42DB.tmp

Executes dropped EXE 1 IoCs

pid	Process
4112	42DB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_9f2e980ebae9d8e8ea4c85f2c05cee5f_amadey_elex_glassworm_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42DB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4112	4084	2026-08-20_9f2e980ebae9d8e8ea4c85f2c05cee5f_amadey_elex_glassworm_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_9f2e980ebae9d8e8ea4c85f2c05cee5f_amadey_elex_glassworm_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9f2e980ebae9d8e8ea4c85f2c05cee5f_amadey_elex_glassworm_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\42DB.tmp
  "C:\Users\Admin\AppData\Local\Temp\42DB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_9f2e980ebae9d8e8ea4c85f2c05cee5f_amadey_elex_glassworm_njrat_smoke-loader.exe 5C1AC8D81657A982AE1B56A847762F030001AD0CEE10BE497B8B14C76E805F47EF9AC7DDACCA7DAEADFE87F1B7DEE05BF3C372A396526F54B098598770960A77
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

42DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\42DB.tmp
Size 3.9MB
SHA256 99f459a50e96c2fd31d6669d3ebd67e15e5d0dc3ddbb635d301d32a8af8042c0
MD5 743931967973e2a93a6e564a92a3c8ce
SHA1 ffe435619b38874bb078ac153589515773506372
SHA512 ebb9825f050dcf965d414cb4d847e3fe7f8a828479dd84394dc2cc83c76a6f333c5a4fc30efc2bc2a323c830e36511a41637c1680ddce1cc7456c395f8dc4488
SSDEEP 49152:Moa1taC070UUntKeSmLWm6dd+/mkC7/L3f+Esb8UUsVmgbQIzZMPXpB91rHpn:Moa1taC01vmLOddQO2FUnnLrHp
TLSH
T184168B57EB814AE9E38D0436EF548150972AF22997FF1261746C420CEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download