Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 06:51
Behavioral task
behavioral1
Sample
2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe
- Size 9.8MB
- Sample260913-hmsw6avyhs
- SHA256 6e0197df1ec6d6dc14e1adb0fd9740eee48e6b0fef486c923df223383c0bac0a
- MD5 0a9254e1fc4671a3223d66ad4b74b77b
- SHA1 c4f3233bb9f79b3440af930e290ac8513b536b48
- SHA512 acd3962a9ad576f26f196bb819de4325011d0a5a147998809cd8a2e919679b517d7810556f6a8f875fa594346a019be625361a5c72b38a1c31fd06ec84bcb270
- SSDEEP 196608:xxjLhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vkllNU0SLGcgUZX76:7/JhllNUHGcgUVluK7aH
- TLSH T186A6D000FAC700B1E867157146EBF22F572891028718DED7F98C5AC9EF23AE25D3579A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-16-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/files/0x00010000000081ea-18.dat UPX behavioral1/memory/2316-20-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2316-35-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\psr.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\print.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\net1.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\at.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\regedit.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\winver.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\sort.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wextract.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\setup16.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe -
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-15-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-16-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00010000000081ea-18.dat upx behavioral1/memory/2316-20-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2316-35-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\wecutil.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..erience-parser-task_31bf3856ad364e35_10.0.19041.1_none_80036e190af52e7c\MbaeParserTask.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\omadmclient.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1_none_3640cf5b039ce2f0\DiskSnapshot.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vdsldr.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\f\wimserv.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\r\RemoteAppLifetimeManager.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\diskpart.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\relog.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\ResetEngine.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrshost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\relog.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6267e352b86de969\setx.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.19041.1_none_8d387dde0a6c6d14\VMCreate.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\audiodg.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\r\ProximityUxHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\SystemSettingsBroker.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_81941817097d6ad9\TokenBrokerCookies.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\r\winresume.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\ApplyTrustOffline.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\f\MicrosoftEdge.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\f\wininit.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\r\appidpolicyconverter.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\r\dnscacheugc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\r\ClipUp.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\Microsoft.Uev.CscUnpinTool.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\r\IMESEARCH.EXE 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15805.0_none_cd052606b14fabac\ServiceModelReg.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\f\winresume.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1_none_f35caf2131abed9a\lsass.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\DeviceCredentialDeployment.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_19667e7e60cb0ccd\RdpSaProxy.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\wininit.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_687f28352b92068b\attrib.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\recdisc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\f\LaunchWinApp.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\r\mavinject.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\f\RuntimeBroker.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.19041.1_none_60b99066bd2f6d16\fsavailux.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\wsl.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\f\PickerHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\f\ProximityUxHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_aa1fc2e87b362d12\regedit.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\BrowserCore.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.1_none_e880d45b6e684cd8\WWAHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\r\bootim.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\MDMAppInstaller.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.19041.1_none_de17915d5c62b62d\mqtgsvc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.19041.1_none_35f6aeed7d8158f9\setspn.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.19041.1_none_646d0595db3c1ad4\EdmGen.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.19200.110_none_11b0c321be81025e\SMSvcHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\f\appidtel.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\f\dnscacheugc.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\f\setup_wm.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\f\Win32WebViewHost.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\Defrag.exe 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_0a9254e1fc4671a3223d66ad4b74b77b_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 12.6MB
- SHA256 e9c40a759ab6c66c155b305e213cd501dab909b596b2117244e3eacdb75682f5
- MD5 b6e9e47482365e06a99d6e722daa9b33
- SHA1 95e57a0c02dcac6e13c5c91c77aec293b186cd95
- SHA512 445e665ea0ede88c4c85dd9e4ac06169fbe498bdc82cc3e3cd95cc82b205d08107b09e70a6116823d8609667948429e464d964f297f98028dbce17ed469726b8
- SSDEEP 196608:xxjLhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vkllNU0SLGcgUZX7T:7/JhllNUHGcgUVluK7aOGi
- TLSH T1E3D6D001EB9640E0D4A7807441ABF22FE73478068724EAD7F98C569AEF237F15E39752
- MD5 SHA1 SHA512 SSDEEP TLSH