Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe
- Size 5.4MB
- Sample260825-162braer2s
- SHA256 51e611fae67ac32ea6014ef0c3bcb60285d99f784e8396cb2de8cb2a8e6e81cc
- MD5 be05de368ca560a88fc05a895de67de3
- SHA1 7be8b6c326facb13c4a935790fa52237675f8714
- SHA512 7386ecd0dd53629868b24b04ee373cb9da3103034d0c32bf9f568223db2c6d9d02fd3e4f2098e9937b8a78c3403ef15268b7c2a296e060074d4d7f86f5d1f3d1
- SSDEEP 98304:HNNsDOb+9SCzNA7mMEMyM4MuMUMQxQeMjLsAAa/7JNzJwjI5kx:g6ioCzNA7rlvRz1neGZF6r
- TLSH T1B346C0896ED09073D17F2AF301ED12404FBC5867A601B28E7DC161F5BD72B609E6E72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\7zG.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\idlj.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\dotnet\dotnet.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javac.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\policytool.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\appletviewer.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jar.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\kinit.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\klist.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\dotnet\dotnet.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.viv 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_be05de368ca560a88fc05a895de67de3_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_nyma.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 7.5MB
- SHA256 283b7c31985cbbe441aaca6100af326121fc5bc255e59043554ab4e0ca4fff73
- MD5 b103668d037308e771a6db954e3c1b14
- SHA1 3182b12a29bf8261ed50cb973c6d88d6aa42c5ba
- SHA512 8c6353c25428a9d5bcec481b75ce626e968c37bc94151ba7223fd0ab58237a2aec157b214d7578676f2a15ac0a5a245ff9389695d4bfbcc0f758a1e41c2dc822
- SSDEEP 98304:HNNsDOb+9SCzNA7mMEMyM4MuMUMQxQeMjLsAAa/7JNzJwjI5kxoq2VjnmQ:g6ioCzNA7rlvRz1neGZF6XGnp
- TLSH T13B86BF497EE4C0A1D1BF96F602ED4241DB7838175B21A7DF6D8151A92D33BE09E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH