5f0ad87ac6b22ecd7b2ada1b9d37df24aca2a81221f6f5b6242bb336da383803

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample260922-lbaszscf97
SHA256 5f0ad87ac6b22ecd7b2ada1b9d37df24aca2a81221f6f5b6242bb336da383803
MD5 e8fcd8545b4783b3a69b49991d6d90f5
SHA1 f36822697a9c56892a1034543b193e352e26218d
SHA512 2f09d476055d4439ab3c0757ce661729ef9cd40d2c578aeac9b7dc7ec815f07963e171f416f6e912a6c8e780a6349d1243b91350f043e75ab892cf675104fca5
SSDEEP 49152:10OXFz9wvJpGVbU3likhfMPbWbUIT96wkxcQWtCAlhtX1Zzx:1VrwvJpGALMPbWYIT6xvW9fXZ9
TLSH
T15016BE1D746160F6ED9B00F4E365FAADAA1CE128C3664CFF528454B2DBE01DA22316FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSyjAqNi.exe	2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
5264	QSyjAqNi.exe
2320	QSyjAqNi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
108	2588	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QSyjAqNi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QSyjAqNi.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2320	QSyjAqNi.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe
2588	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 5940	3320	2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 5940 wrote to memory of 5264	5940	2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 5264 wrote to memory of 2320	5264	QSyjAqNi.exe	92
PID 2320 wrote to memory of 2588	2320	QSyjAqNi.exe	93
PID 2320 wrote to memory of 2588	2320	QSyjAqNi.exe	93
PID 2320 wrote to memory of 2588	2320	QSyjAqNi.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSyjAqNi.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSyjAqNi.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSyjAqNi.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSyjAqNi.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-21_e8fcd8545b4783b3a69b49991d6d90f5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 808
        6⤵
        Program crash
        
        PID:108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2588 -ip 2588
1⤵
PID:52

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QSyjAqNi.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSyjAqNi.exe
Size 3.4MB
SHA256 ddc700e68e04039d03c695613206cc6988e47df4d9ac1276611baa13ab9574a9
MD5 7a4b9d9baec372ef276fb30f33cce6a2
SHA1 286030a32d492c8ff42048eb37a592424c025e02
SHA512 4ec2130b72f2da82c58b3036da9e2ac7d14d444e0171068f2a7bcd26ac31f4ae109c0f991651798022de89c7171b3f80143df04123e4edd3c9632516a6a2be09
SSDEEP 24576:XKjmUTQoZQsFJ5QqUD7TYfsnGl4G2SFBjrum1fTnS:XCmU8Tejni7wX4GNXt7nS
TLSH
T1A2F5BD4FE0779815E382A4FEA51A105D06996DE3A758C971CD90213FCAAF8F23B4C9D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2320-25-0x0000000077328000-0x0000000077329000-memory.dmp

Download

memory/2320-21-0x0000000077328000-0x0000000077329000-memory.dmp

Download

memory/2320-30-0x0000000000BF0000-0x0000000000C8E000-memory.dmp

Download

memory/2320-26-0x0000000000BF0000-0x0000000000C8E000-memory.dmp

Download

memory/2320-27-0x0000000077328000-0x0000000077329000-memory.dmp

Download

memory/2320-24-0x0000000077328000-0x0000000077329000-memory.dmp

Download

memory/2320-17-0x0000000000BF0000-0x0000000000C8E000-memory.dmp

Download

memory/2320-22-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/2320-19-0x0000000077328000-0x0000000077329000-memory.dmp

Download

memory/2320-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2320-23-0x0000000077328000-0x0000000077329000-memory.dmp

Download

memory/2588-28-0x0000000001680000-0x0000000001719000-memory.dmp

Download

memory/2588-31-0x0000000001B20000-0x0000000001BBE000-memory.dmp

Download

memory/2588-33-0x0000000001B20000-0x0000000001BBE000-memory.dmp

Download

memory/3320-0-0x0000000000400000-0x00000000007FD78F-memory.dmp

Download

memory/3320-10-0x0000000000400000-0x00000000007FD78F-memory.dmp

Download

memory/5264-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5264-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5940-1-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5940-16-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/5940-13-0x0000000000400000-0x00000000007FD78F-memory.dmp

Download