Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/09/2026, 04:31
General
- Target 2026-09-13_6f693846ffabd4214133485b28dbb2ab_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 6.6MB
- Sample260914-e5j57agm3s
- SHA256 6693dc969300330cbc81529fadf2c9eb6f8ef6effec235059126150df1cbe92b
Malware Config
Signatures
- Family: Beapy
Beapy is a python worm with crypto mining capabilities.
- Contacts a large (9395) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Loads dropped DLL 29 IoCs
- Domain Trust Discovery 1 TTPs
Attempt gathering information on domain trust relationships.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Permission Groups Discovery: Domain Groups 1 TTPs
Attempt to find domain-level groups and permission settings.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_6f693846ffabd4214133485b28dbb2ab_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_6f693846ffabd4214133485b28dbb2ab_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_6f693846ffabd4214133485b28dbb2ab_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_6f693846ffabd4214133485b28dbb2ab_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c wmic ntdomain get domainname3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ntdomain get domainname4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net localgroup administrators3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net group "domain admins" /domain3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet group "domain admins" /domain4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
C:\Windows\SysWOW64\netstat.exenetstat -na3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Crypto.Cipher._AES.pyd
Crypto.Cipher._DES3.pyd
Crypto.Util.strxor.pyd
ii.exe.manifest
python27.dll
win32api.pyd
Crypto.Cipher._ARC4.pyd
Crypto.Cipher._DES.pyd
Crypto.Hash._MD4.pyd
_ctypes.pyd
_hashlib.pyd
_mssql.pyd
_multiprocessing.pyd
_socket.pyd
_ssl.pyd
bz2.pyd
msvcr90.dll
pywintypes27.dll
select.pyd
win32event.pyd
m2.ps1
memory/3536-83-0x0000000002E20000-0x0000000002E30000-memory.dmp
memory/3536-47-0x0000000002D40000-0x0000000002DF5000-memory.dmp
memory/3536-70-0x0000000001270000-0x0000000001280000-memory.dmp
memory/3536-58-0x0000000003620000-0x000000000369C000-memory.dmp
memory/3536-43-0x0000000001250000-0x000000000125C000-memory.dmp
memory/3536-87-0x0000000002E30000-0x0000000002E45000-memory.dmp
memory/5684-91-0x00000190D7F70000-0x00000190D7F92000-memory.dmp
memory/5684-95-0x00000190F0DE0000-0x00000190F0EE0000-memory.dmp