0d0556aeb2d1b986f33db6f57bb47cfb459bb90be3c43a204de7051d44977a15

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260907-taf8dacl41
SHA256 0d0556aeb2d1b986f33db6f57bb47cfb459bb90be3c43a204de7051d44977a15
MD5 7d5a07c0b42fc00319e0ff7bfcba93e5
SHA1 0034efbce9f12bab353a59e028d67ca85b5a0ba5
SHA512 e200715c7c55344eaee8a44f4bbab00886cb4c286a96a06eced04682d75c7f29d1e7f40dade57c155e124be0bfb37b959a81b37672143046249073d4aeee82ba
SSDEEP 49152:mcxzx0OjvSH3rfzPQq6gm5Q90OXFz9wvJpGVb:mctx0Ojvs3rfzPQ89VrwvJpG
TLSH
T1A316D021B6C0B032E6E1207B7AF7D7728A2ED539AF14C0F35294D0E1D9F11DD2635A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2sUE5ANbWIG.exe	2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
4952	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	4812	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2sUE5ANbWIG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2sUE5ANbWIG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
5664	2sUE5ANbWIG.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe
4812	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4620	4904	2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 4620 wrote to memory of 4952	4620	2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 4952 wrote to memory of 5664	4952	2sUE5ANbWIG.exe	92
PID 5664 wrote to memory of 4812	5664	2sUE5ANbWIG.exe	93
PID 5664 wrote to memory of 4812	5664	2sUE5ANbWIG.exe	93
PID 5664 wrote to memory of 4812	5664	2sUE5ANbWIG.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2sUE5ANbWIG.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2sUE5ANbWIG.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2sUE5ANbWIG.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2sUE5ANbWIG.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-05_7d5a07c0b42fc00319e0ff7bfcba93e5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 752
        6⤵
        Program crash
        
        PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4812 -ip 4812
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2sUE5ANbWIG.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2sUE5ANbWIG.exe
Size 3.4MB
SHA256 4315e839067105ae82668f60f2b6e3810eafbad587a45955d3f2300be72221b5
MD5 6b0ca0beb4b7dca1c27ca087c3dd972c
SHA1 9f1bf66f0316898cc99c3b7550bf91aa4a4c843a
SHA512 20f14d6fa04d929384623e5cc7bf8babca6762c7bf042a1fcf36b816fb50bcc82e094b2e527055f360f94dac10d5932f872d12e212a274bb73693de86b00310c
SSDEEP 24576:Kh5s5XceTJTRsyj9Wy5a6SwUpUKk1PUxMzRp8gyudnHD+iN9gFOBc0hf:05s5MeTJt7j0ytwUKkjzRNFSir
TLSH
T14CF5CE5CC523D1AD8AC7FCB05898037B2038A57B57F9BF2CF6D0B94992A044B9E25397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4620-1-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/4620-15-0x0000000000400000-0x00000000007FD62C-memory.dmp

Download

memory/4620-16-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/4812-28-0x0000000001050000-0x00000000010E9000-memory.dmp

Download

memory/4812-33-0x0000000001690000-0x000000000172E000-memory.dmp

Download

memory/4812-30-0x0000000001690000-0x000000000172E000-memory.dmp

Download

memory/4904-10-0x0000000000400000-0x00000000007FD62C-memory.dmp

Download

memory/4904-0-0x0000000000400000-0x00000000007FD62C-memory.dmp

Download

memory/4952-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4952-19-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5664-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5664-23-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5664-24-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5664-25-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5664-26-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5664-27-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5664-22-0x0000000002760000-0x0000000002761000-memory.dmp

Download

memory/5664-20-0x0000000077038000-0x0000000077039000-memory.dmp

Download

memory/5664-31-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5664-18-0x0000000002660000-0x00000000026FE000-memory.dmp

Download