a1b62a16c306e5db27ef6a6d350c0dd06499f3a1193454ecf31dcf8619d11e4b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_fabb3a89728ea068224b0a24c323f5aa_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260925-vfxb8a1flf
SHA256 a1b62a16c306e5db27ef6a6d350c0dd06499f3a1193454ecf31dcf8619d11e4b
MD5 fabb3a89728ea068224b0a24c323f5aa
SHA1 3e171cbe364b1291659af9f8de69401bf8069db1
SHA512 5facf1ee532e90ee818d89e4a0f45b57d5d4b2b989782680603877e2749055ef8e90ce92f60e42752e4ded7232a8dc36f48e264dc32844bf6cd8be114e489d86
SSDEEP 98304:Z0nAAYEpbhg9OU/jIEeQfoR/IuOFVjUu5j:+Nc9FIF0wuZ
TLSH
T1A9F5AE11F6C284B2F573017148AAD7795630BD65423289AFF7CCDA0DAF719C29A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2668	original_temp.exe
2216	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_fabb3a89728ea068224b0a24c323f5aa_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2216	original_temp.exe
2216	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 2668	5500	2026-09-25_fabb3a89728ea068224b0a24c323f5aa_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2668 wrote to memory of 2216	2668	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-25_fabb3a89728ea068224b0a24c323f5aa_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_fabb3a89728ea068224b0a24c323f5aa_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\jds240727953.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240727953.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX35CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX35CF.tmp
Size 1.1MB
SHA256 9155e6a2c4e136a7c32a30908411908ca6de728fcd94566f568173e36c72d00c
MD5 a3566d3bfafc56cbfd2200d6ad2bfbe2
SHA1 b583756fa060925627281d70847972829754e616
SHA512 3333507e67915245110a18d58ca70c0f9e890ee782dafbd67bab258b49e7d67d99b8afa9076aab18cbd572a182fb3b357202988c3c2dfda60846c0f29093e39c
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8A+wru:i6F0eMpAAYEhpvhw6
TLSH
T1CA356DA4E78394F5ED2314F1444FEBFBA5309E194031CD6BFB88DE10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240727953.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 b73ed848af729be1abdbcf6de38df42d2e2f3bbf86e6ac845db2209da35fdf9c
MD5 681849ecdaf9dd6890619acc57b5ecd4
SHA1 93ab7d3e3d811decff1752159ff98a98f9ee4488
SHA512 7562395a70ded45304d09837d57f1224b99f55282e7c28586175c621fbaefc6b04d9d3bd3c1cd62717bd6864a482780afabc8c383efbf186224b384da22c6b20
SSDEEP 3072:QdJp6zZkin11os1FlRJA9xVLnCQ77RLUFActrfsDsY0L:IUJ5X
TLSH
T1D8F36647866E44FB34130FA3C76A5C689563272D535E4F2D31EF828EA041E03D6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 c1174cde1cd41059368e8b6413d57f4ddadcf5fb99355d9cd3b8de7e5572f268
MD5 7efdc952535b7bfcae0555c5cbfc839a
SHA1 6913c65f904876e4aa5bd7b606c0f9cf4e3e4d6c
SHA512 5582787616b6fd3fc9dee32637d8466eea8aa7a952ba3f7e1e93746d03d62b37abee0f6e37e89f21037630757b492cdd2b88b93fce0a8d7500d68afc7b22a858
SSDEEP 3072:QdJp6zZkin11os1FlRJA9xVLnCQ77RLUFActrfsDsY0B:IUJ5d
TLSH
T11AF37647866F44FB34130BA3C76A5C689563272D535E4F2D31EF828EA041E03D6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a87c3e80075af8250824d5f4c5ab588d27951de997343a70dde620eff38f41bd
MD5 f72ff5b19c79efdef734a455c9c4aa23
SHA1 33c4ecfc25be44a79548b2a72741740f77a4802b
SHA512 fc24a55863f95bcb0dbf42c17f064b6295e3a9f4d0756c60388016f64aada721653f6e1b4daaaac1ba013115a1569817480427c5a485b2c09c445ad335617978
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsA+w+a:26F0eMpAAYEhpbhw5
TLSH
T1B4356DA4E78394F5ED2314F1044FEBFBA5309E194031CD6BFB88EE50BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5762d1b2a3c01c202cc9fab1e980a25450ef84104f9d4d220fecb5bb5471642b
MD5 7e24d9d88a57aa09e60456eb31691728
SHA1 2dd85c16ab079cf4f712602b58ccf6fc2a424898
SHA512 5a931ecdfba1d253422cd6fa897174d580ac44657ba7b5eb116984f9761300576801e39226025b9210de00cebd507224ba80cfd7bb576d95fd573ed530ee8abd
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdA+wMe:26F0eMpAAYEhpihw3
TLSH
T1AF356DA4E78394F5ED2314F1044FEBFBA5309E194031CD6BFB88EE50BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5e63139bc9ba0cb865dfe795fa259c826e909b2b5ec71cf2ed4454a7fd59a188
MD5 956f9ca3441ad8cab42762c573b29d10
SHA1 befcc6a1a360ef3735dcd3fe73846edf3954b3ee
SHA512 38c71118ea2f5995168fbcc9b25f01ee0bf9ef64fdb45bd26444159fde88d4af950012e0615a00fe82c778265f345ca5b72a1306c59888eb67ad9e7a7ec30ddb
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO9A+wrk:y6F0eMpAAYEhpKhww
TLSH
T15C356DA4E78394F5ED2314F1044FEBFBA5309E194031CD6BFB88EE50BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 519a3409bef3743c9589712b2ca1a8015fc2b51b3f7034fbddf88b8ae6fe771e
MD5 c54bd54d11c8950789754c6ba117665c
SHA1 baebf0da40743df212d9e8d95dd029f2a81f9108
SHA512 88672756986e9776c6f0fe2d7b53fd4b216c1c954269cd66410fc4380f7b700134cd8d410d50a1afce5ac129f9192f6e2361d7a4a0c24d8c29c6cc393c19d5e7
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxA+wf5:m6F0eMpAAYEhpuhwB
TLSH
T159356DA4E78394F5ED2314F1044FEBFBA5309E194031CD6BFB88EE50BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a4cb3f2673440f075938f8d3ec514e9d0abcff14717353147b27111c7e74a5d5
MD5 92627532921201988f37d62cd10deed4
SHA1 d33431719406d6fa9f88050daac79f7a0e7d844a
SHA512 4065c9736ec9cc2f51f89b11dced51a5ac47618d54131948dd25353d2fa0351b5ab653a0c587373c1a1d4376368d9685774e1ddb97036aa7f2bb6ebfbb7683f1
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOoA+wrm:+6F0eMpAAYEhpzhwy
TLSH
T1A8356DA4E78394F5ED2314F1044FEBFBA5309E194031CD6BFB88EE50BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5500-318-0x0000000000400000-0x0000000000527000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads