27e9be4ef7b167a0cb2d247a0ab67120e0f0a1e0abf72c4912bae28e519ea0e7

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260824-saw36ahn7x
SHA256 27e9be4ef7b167a0cb2d247a0ab67120e0f0a1e0abf72c4912bae28e519ea0e7
MD5 2c7ed206e84d6d107b54ffd8753f87bd
SHA1 38e4fae72733a3105f2cd4fbdbe7422d6298775b
SHA512 a9d04fef6d33ec731c7ea9513e1bde0f65b675f2e8af5e1b97e377f64eac875f9279e538b1f53c8be059318f1fa5b931612007d24afcd1960ecb19c329b3cb6c
SSDEEP 49152:il6whsJUNuT12onHe/y2LRWk0OXFz9wvJpGVb:iZhA12onHsxwkVrwvJpG
TLSH
T14516CF216D529039F4ED0C78A2A6C7738D2E9E203FD885D7D2D037A66621CD2D27CE76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rHX2ETvbQ.exe	2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
5172	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	5524	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rHX2ETvbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rHX2ETvbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
4844	rHX2ETvbQ.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe
5524	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 3512	5832	2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 3512 wrote to memory of 5172	3512	2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 5172 wrote to memory of 4844	5172	rHX2ETvbQ.exe	92
PID 4844 wrote to memory of 5524	4844	rHX2ETvbQ.exe	93
PID 4844 wrote to memory of 5524	4844	rHX2ETvbQ.exe	93
PID 4844 wrote to memory of 5524	4844	rHX2ETvbQ.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rHX2ETvbQ.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rHX2ETvbQ.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rHX2ETvbQ.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rHX2ETvbQ.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_2c7ed206e84d6d107b54ffd8753f87bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 788
        6⤵
        Program crash
        
        PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5524 -ip 5524
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rHX2ETvbQ.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rHX2ETvbQ.exe
Size 3.4MB
SHA256 3a8df7edd57cf57c09c7082909cce8d4edd337033e14288420d455ce30413553
MD5 a9ac6ddfaa23b8e646178a6f29f5f23a
SHA1 24b7a7db2da9b99f1e595065ea28b16df286fe4b
SHA512 d362ec6f5422013dfe3f5a2f1a2618ccddb27e37f5506dcc5c428c8f5b9ae36eab9dd25fc0956753a61c6215f1fbba111c307243992d6334e79d6f5b1a3e1682
SSDEEP 24576:xLBBh5JLzHVi+ICC3yQH6rT8SP16SqMueWeIRc1W4oGCwPg2DDZFu:1BzDn1TICCFH6ndP16S+MWgC8DDZ
TLSH
T123F5EFB1B84C0BF6D63200FFEFEE55EF0A4C66D59AE40845B19B68C18D701E7F49A498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3512-15-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/3512-1-0x0000000002690000-0x000000000272E000-memory.dmp

Download

memory/3512-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4844-24-0x0000000077948000-0x0000000077949000-memory.dmp

Download

memory/4844-25-0x0000000077948000-0x0000000077949000-memory.dmp

Download

memory/4844-28-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4844-17-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4844-22-0x0000000077948000-0x0000000077949000-memory.dmp

Download

memory/4844-19-0x0000000077948000-0x0000000077949000-memory.dmp

Download

memory/4844-20-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/4844-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4844-23-0x0000000077948000-0x0000000077949000-memory.dmp

Download

memory/5172-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5172-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5524-26-0x0000000001380000-0x0000000001419000-memory.dmp

Download

memory/5524-29-0x0000000001A90000-0x0000000001B2E000-memory.dmp

Download

memory/5524-31-0x0000000001A90000-0x0000000001B2E000-memory.dmp

Download

memory/5832-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5832-10-0x0000000000400000-0x00000000007FE000-memory.dmp

Download