05ccbd147f91065f5f22ec07be00a49bd03988c8be363001148844854730d16c

General

Target
2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260925-vgtbyswtcs
SHA256 05ccbd147f91065f5f22ec07be00a49bd03988c8be363001148844854730d16c
MD5 f9b11ac07ecb5bcad50a6cadecaa56d1
SHA1 6244a3cedb811d4f39133fa930bfe37d29c8e2ba
SHA512 07107b32301d0b289986b45b44930a7678392548bdb9f95059d3113fc5698ea6878d2ee47cf456da54ccdde155be2d0b05173f941e2104c1dd26fa0020c6284e
SSDEEP 98304:p0nAAYEpYh49OU/jIEeQfoR/IuOFVjUu5t:uNh9FIF0wuf
TLSH
T18FF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3512	original_temp.exe
5040	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3512	3312	2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 3512 wrote to memory of 5040	3512	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Local\Temp\jds240671578.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240671578.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX58AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX58AA.tmp
Size 1.1MB
SHA256 686496ec6cee34b6ab244bc7e9e8456576864340e8e9a8600309e158ad4e6041
MD5 d87b86a46c722d99793a3c6ae9518416
SHA1 3df4d64eddad1b4ff5db1745afa0630d500e3c62
SHA512 4d64db4f3ec150341685ab9dfe3289fa07e82960f9a74e675103fa1961f4319be1c12e3f6d57a5555519698ed8be2349d41e025880f452fe1621a0d42063ad38
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOCYA+wdn:G6F0eMpAAYEhpYhwx
TLSH
T11E456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5AC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5AC1.tmp
Size 1.1MB
SHA256 6a380c9ad556a406a84df140c8b57285b0551a74530b45ca1c7075ac50e3ae6d
MD5 3a9dcb663060a48dc15c830e1cc202cf
SHA1 087a7f88bb7b44265025b2d617b71d5c080402f9
SHA512 c967c7f93acb1e0516fb14dfa2f5b7e8aebd0de055c5d7b29238eabd72eee4097e20317d6e46842274cb9c99ffe7926b3d85e0783c82a0e22f5e636dbe2d531c
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+w0q:V6F0eMpAAYEhpShwD
TLSH
T1A0456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240671578.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 e2bd896f79044f02e0b9922c96e1562a8145524590a2b627351fd36106cfc8e0
MD5 f2c0fd76ca71c7666e65c82c4ce5e803
SHA1 1565b014b2ca3efe9e3906be1d5bdcdee575ba10
SHA512 1670514d4d66251f37ce3fbaf3f0327b20929b884c4df74bf0711268e753828e114f8b95f0fa7e42385e109574a97a3b9b117510dcd90db55d40b7fc2ea665a6
SSDEEP 3072:GyvsYNfijKI9WeI58FSQZL6TyET2UDDRiP7wxHUCxzYnc:6NS7
TLSH
T1C7F33087846E45BB34530BA7C36E5C6446771729439E4A2D31EFC2CEA445A03C6AE8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 185KB
SHA256 e0e2a9ed024e94538c2804dd168e6cdf52c96780c0b02c707e136d26c783970e
MD5 5d3a93df9ec09107111aedac7fc4b55a
SHA1 48a971fa700291a1f650f758bddabe258dfaa975
SHA512 48293c97cba95ae6ec5726424dfa6c1e1d96d90025ebcfcce64e5d6e4f1cd7771c939cad097a39905df09fe47c4f1af60feec9981d4c11745b7efca9334df718
SSDEEP 3072:GyvsYNfijKI9WeI58FSQZL6TyET2UDDRiP7wxHUCxzYnzW9:6NS9
TLSH
T1C9045287856E45BB34130BA3C36A5D648673172947AE4A2D31EFC2CEA445E03C66F4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 d16e0471db7c83bca61837e3f273030e8042870f3c18c00ce0f30985a10b3a14
MD5 7453221ffd80e93ae5adc8846896da6a
SHA1 e9ca5ca15b5b73aad808f2a1da1ca119a7d58e79
SHA512 2f1330af40964f2e47d8c0b7e9db26c794e4ba33dad3e158e2cc93ecb3da958389b7947f4f72c802c6d6dfe44b75aa190ead1c6a8998fe93dda0cdcbd6f7237a
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfYA+wdv:66F0eMpAAYEhpDhw5
TLSH
T186456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3312-447-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads