Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/09/2026, 02:15

General

  • Target
    2026-09-06_621b2a6c00caebde8e81d88e22ef01d5_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 7.7MB
  • Sample260907-cpsraavvbv
  • SHA256 b18dfa25c93818d14d9c997d0175ec1e57d63e4a81d2abb2e81a841702bc9e10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-06_621b2a6c00caebde8e81d88e22ef01d5_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-06_621b2a6c00caebde8e81d88e22ef01d5_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Users\Admin\AppData\Local\Temp\2026-09-06_621b2a6c00caebde8e81d88e22ef01d5_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-06_621b2a6c00caebde8e81d88e22ef01d5_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Miditari 0.10.exe.manifest

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\Miditari 0.10.exe.manifest
        • Size 1KB
        • SHA256 fb4ea7f522a8110a0316ed7491a787cafdeb6cb528d86e97baf46616f7dda3ab
        • MD5 SHA1 SHA512 TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\VCRUNTIME140.dll
        • Size 84KB
        • SHA256 1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\_ctypes.pyd
        • Size 105KB
        • SHA256 e740232c68e08db0cfd3fe615817117caa80bdef5276c536d3cd22e9c18987c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _hashlib.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\_hashlib.pyd
        • Size 31KB
        • SHA256 4504720c2dfd09770d53ba71c8ba64d128b51284f3942a5964390416de481d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\_socket.pyd
        • Size 65KB
        • SHA256 a05ba444c837fb4d43174b6552fcaefa2952ad31c620a3ead9b001ce4bf7928a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _tkinter.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\_tkinter.pyd
        • Size 56KB
        • SHA256 4319e1b77c3084517e67db170400ceee2df02c611c576c040305bf897130e18f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\base_library.zip
        • Size 767KB
        • SHA256 a419e9dbc46d24880e89759600f71280256b0dee2caafa83517dad3aa1a89e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\libcrypto-1_1.dll
        • Size 1.8MB
        • SHA256 53b15bd69ae5bdc8919a9929572d1d69e1c5b1c6270cdd3ea585256ca8b0fc2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python37.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\python37.dll
        • Size 3.5MB
        • SHA256 f4c1615cd001d583e7e0f60693b73f16e5e60766f4da2262d9cdc557136f6d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _rtmidi.cp37-win32.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\rtmidi\_rtmidi.cp37-win32.pyd
        • Size 175KB
        • SHA256 d19eaa41f5b4cf961d1846f8e3eafb54c1d350a964487eaeee8864800448dfcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\select.pyd
        • Size 22KB
        • SHA256 6ccdb8f35b1c4aaa3305d09fe0f19bc2fdd79d306d93c9a771c3a3b97e7bda8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tcl86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl86t.dll
        • Size 1.3MB
        • SHA256 a30890660bfb6bc7b091f40c11fc5ed2bd4a9f4efa8903047245369853746773
        • MD5 SHA1 SHA512 SSDEEP TLSH

        auto.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\auto.tcl
        • Size 20KB
        • SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cp1252.enc

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512 TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\http1.0\pkgIndex.tcl
        • Size 735B
        • SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
        • MD5 SHA1 SHA512 TLSH

        init.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\init.tcl
        • Size 23KB
        • SHA256 09d60a9ec3c51badcec93b2adf7bd679e50094ab945968f650fad899483e29d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\opt0.4\pkgIndex.tcl
        • Size 607B
        • SHA256 eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718
        • MD5 SHA1 SHA512 TLSH

        package.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\package.tcl
        • Size 22KB
        • SHA256 47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tclIndex

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\tclIndex
        • Size 5KB
        • SHA256 abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tm.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tcl\tm.tcl
        • Size 11KB
        • SHA256 6437bd7040206d3f2db734fa482b6e79c68bcc950fba80c544c7f390ba158f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk86t.dll
        • Size 1.2MB
        • SHA256 5182eb6a38550cfd5312f694bb234c148cb4c073e46562753dea43540e9f12ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        button.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\button.tcl
        • Size 20KB
        • SHA256 0d95949cfacf0df135a851f7330acc9480b965dac7361151ac67a6c667c6276d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        entry.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\entry.tcl
        • Size 16KB
        • SHA256 8f57a23c5190b50fad00bdee9430a615ebebfc47843e702374ae21beb2ad8b06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\icons.tcl
        • Size 10KB
        • SHA256 a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161
        • MD5 SHA1 SHA512 SSDEEP TLSH

        listbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\listbox.tcl
        • Size 14KB
        • SHA256 6aae8a7501fc6df8199b39b5d2f808697af5bd2df4076fd31e2ca060e05ee7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menu.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\menu.tcl
        • Size 37KB
        • SHA256 b31e97d81f2448089dd727933ee2310785ec1fcf90892f3432473e79111524bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panedwindow.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\panedwindow.tcl
        • Size 5KB
        • SHA256 4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\pkgIndex.tcl
        • Size 363B
        • SHA256 af676d86dab8128b2f5edbc2381ad1a268aa47f8638221e5336501ce5aeec517
        • MD5 SHA1 SHA512 TLSH

        scale.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\scale.tcl
        • Size 7KB
        • SHA256 58c662dd3d2c653786b05aa2c88831f4e971b9105e4869d866fb6186e83ed365
        • MD5 SHA1 SHA512 SSDEEP TLSH

        scrlbar.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\scrlbar.tcl
        • Size 12KB
        • SHA256 6ba3e2d62bd4856d7d7ae87709fcaa23d81efc38c375c6c5d91639555a84c35d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spinbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\spinbox.tcl
        • Size 15KB
        • SHA256 5d6e939b44f630a29c4fcb1e2503690c453118607ff301bef3c07fa980d5075a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        text.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\text.tcl
        • Size 32KB
        • SHA256 e21d49ed17e0664d45ecb5d9eba916f115586df674afdf85c73a47349e177a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\tk.tcl
        • Size 22KB
        • SHA256 2a38276bb140f3ae1a7cc7ec6993e672a6071f435683c8eb8881db5e88aa67ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        altTheme.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\altTheme.tcl
        • Size 3KB
        • SHA256 e05c26006855331a641610300f3290e5f8cd8143f42381c11e0930b0300a2005
        • MD5 SHA1 SHA512 TLSH

        button.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\button.tcl
        • Size 2KB
        • SHA256 391b6e333d16497c4b538a7bdb5b16ef11359b6e3b508d470c6e3703488e3b4d
        • MD5 SHA1 SHA512 TLSH

        clamTheme.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\clamTheme.tcl
        • Size 4KB
        • SHA256 adf44e26610d8f6b8037c44f650992eb9eba76f812a7a8a070a469237bbfc7d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classicTheme.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\classicTheme.tcl
        • Size 3KB
        • SHA256 535835e6504f48948e1b97c7ad1cd0f1e309570edc99cb97de26fdf2bbeb5840
        • MD5 SHA1 SHA512 TLSH

        combobox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\combobox.tcl
        • Size 12KB
        • SHA256 99d4faf0c79ac2873912bc56bfcb80a50711de90ef82e8b6777be1d086558cfe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cursors.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\cursors.tcl
        • Size 3KB
        • SHA256 7bdffa1c2692c5d1cf67b518f9acb32fa4b4d9936ed076f4db835943bc1a00d6
        • MD5 SHA1 SHA512 TLSH

        defaults.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\defaults.tcl
        • Size 4KB
        • SHA256 26c12c05a00f06bfc2850b9e63973752cd3ea9ff61d69b674277e06be0aa0070
        • MD5 SHA1 SHA512 SSDEEP TLSH

        entry.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\entry.tcl
        • Size 16KB
        • SHA256 f3507df2a512edb3b6a5d4f97bd0f389f8f71c5e5c811bc47026817012acc41a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fonts.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\fonts.tcl
        • Size 5KB
        • SHA256 0eb518251fbe9cf0c9451cc1fef6bb6aee16d62da00b0050c83566da053f68d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menubutton.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\menubutton.tcl
        • Size 4KB
        • SHA256 81b0b7818843e293c55ff541bd95168db51fe760941d32c7cde9a521bb42e956
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notebook.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\notebook.tcl
        • Size 5KB
        • SHA256 d1e5267cde3d7be408b4c94220f7e1833c9d452bb9ba3e194e12a5eb2f9adb80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panedwindow.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\panedwindow.tcl
        • Size 1KB
        • SHA256 ce0053d637b580170938cf552b29ae890559b98eb28038c2f0a23a265ddeb273
        • MD5 SHA1 SHA512 TLSH

        progress.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\progress.tcl
        • Size 1KB
        • SHA256 a9c34f595e547ce94ee65e27c415195d2b210653a9ffcfb39559c5e0fa9c06f8
        • MD5 SHA1 SHA512 TLSH

        scale.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\scale.tcl
        • Size 2KB
        • SHA256 25d0fe2b415292872ef7acdb2dfa12d04c080b7f9b1c61f28c81aa2236180479
        • MD5 SHA1 SHA512 TLSH

        scrollbar.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\scrollbar.tcl
        • Size 3KB
        • SHA256 5932043286a30a3cffb2b6ce68ccdb9172a718f32926e25d3a962ae63cad515c
        • MD5 SHA1 SHA512 TLSH

        sizegrip.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\sizegrip.tcl
        • Size 2KB
        • SHA256 ed31fa0b0d3438acad3384dde1e562033e0d9a035e5056322da219d6c4cbd912
        • MD5 SHA1 SHA512 TLSH

        spinbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\spinbox.tcl
        • Size 4KB
        • SHA256 51f8a6c772648541684b48622ffe41b77871a185a8acd11e9dec9ec41d65d9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        treeview.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\treeview.tcl
        • Size 8KB
        • SHA256 3cadaea517d5cbb1f2ae09f8f5caef7b7d0104e71c07be7263d9af158ce2699d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ttk.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\ttk.tcl
        • Size 4KB
        • SHA256 61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        utils.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42202\tk\ttk\utils.tcl
        • Size 8KB
        • SHA256 c7cc9a15cfa999cf3763772729cc59f629e7e060af67b7d783c50530b9b756e1
        • MD5 SHA1 SHA512 SSDEEP TLSH