05ccbd147f91065f5f22ec07be00a49bd03988c8be363001148844854730d16c

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260925-vgtbyswtcs
SHA256 05ccbd147f91065f5f22ec07be00a49bd03988c8be363001148844854730d16c
MD5 f9b11ac07ecb5bcad50a6cadecaa56d1
SHA1 6244a3cedb811d4f39133fa930bfe37d29c8e2ba
SHA512 07107b32301d0b289986b45b44930a7678392548bdb9f95059d3113fc5698ea6878d2ee47cf456da54ccdde155be2d0b05173f941e2104c1dd26fa0020c6284e
SSDEEP 98304:p0nAAYEpYh49OU/jIEeQfoR/IuOFVjUu5t:uNh9FIF0wuf
TLSH
T18FF59E11F6C6C4B2F5730171486AD7B95630BD65413288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1836	original_temp.exe
2472	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2472	original_temp.exe
2472	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1836	3504	2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 1836 wrote to memory of 2472	1836	original_temp.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_f9b11ac07ecb5bcad50a6cadecaa56d1_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Local\Temp\jds240762625.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240762625.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 23b7b7a56ca117af543123b53e460d3de130615bf8629e445fe7608771b48aa3
MD5 cfd39812b44a802082504bb65861812d
SHA1 b49af6d72bb76a7465744d03d6097e3cadfe6143
SHA512 6ab20e2bd8988e3a50e23b8d2e66960b732bee42274ee9ede5e363515ce661e1bcd91cf80aeef40326aa8e68fcb76a5fb69341e225133ee270c517f9056393e6
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO1YA+wdf83npi63it:e6F0eMpAAYEhpBhwp8XpiMc
TLSH
T198756B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 18b1e2a7dce7cde1af4495ebba6d6379441eea8627806e2b8b40689fd159a12c
MD5 f8fa8704ff568101544a4e503ab91fa3
SHA1 04d768f95c29eaa03ac777b13bb96761d4373594
SHA512 255093c638827df343ef846108b896162e70fc310c0ce9089f7761927c1d0cc65e6b69af196fa4cc0afe02c3614b1a314111f945ea5cd1342cde5cf48186a44e
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHYA+w0inMYenGJiKEbXWtQ:G6F0eMpAAYEhpnhw7MPnRWt4N
TLSH
T165759E74E783D4F1E92300F1444BE7BA69349E1944318C7BEBC8EF15BAB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 933c9a5b130efe98532794de657c70406ee90ac1bbc02984bc81cc4e60b7d3d0
MD5 2f715a51899d831a167030b80da0f2f9
SHA1 0740966679e39d810e70672956a27686ccdf6ccd
SHA512 74c6d61940b5986f39770e725833db731561cea87c19a155c3eb42a94f0432620b9b770467b3df738ddf1b1d41c8beed7e34541454e6534d46eb28d480519b80
SSDEEP 393216:LWlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vX3:LKWO1c877xqpyovvVWJ6VFK+q3cSvX3
TLSH
T1665712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBE07.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXBE07.tmp
Size 1.1MB
SHA256 6a380c9ad556a406a84df140c8b57285b0551a74530b45ca1c7075ac50e3ae6d
MD5 3a9dcb663060a48dc15c830e1cc202cf
SHA1 087a7f88bb7b44265025b2d617b71d5c080402f9
SHA512 c967c7f93acb1e0516fb14dfa2f5b7e8aebd0de055c5d7b29238eabd72eee4097e20317d6e46842274cb9c99ffe7926b3d85e0783c82a0e22f5e636dbe2d531c
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+w0q:V6F0eMpAAYEhpShwD
TLSH
T1A0456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240762625.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 af95ff0f4d5c8c4ddf8f88b9d32f0b5db97204a9fd4545b7bc7e7ff3dce73cb3
MD5 06d7f3d1579d4365056349c779565976
SHA1 59a4d5022210f04581d748bbd78b733709757f00
SHA512 ebbe9a355f6c8ab6a4f6bc3cf360335c8e9d867b1f1a56de3947a19de4f016e6b4111cf31df4994d09574f12794404869cea7600ab03ee69186264a19e1be108
SSDEEP 3072:mQzZMnRfxLO7ATq5k29RE7sCc2sjjxIE2dtWWzqJSsW:eNU4
TLSH
T159F386878A7E85BB34130BE3C769AC594952263D535E0B1C61EF92CEE041A03D5BE4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 179KB
SHA256 77a45b8d82422397f116ac70d32aa408164fc859dfb2b5b1f7f342b40a5ad72c
MD5 e11afc2124cf843a76d6680667b20103
SHA1 f1987ec40ae7e75cd3bd2f1770c749da2e0bc1c7
SHA512 2d300542b1701e76dfa80e10036decfb6a9252690e18dec782f7099b009b66f34d84a28ec0d26d9c8364e3bbe3d4d48a096647ad233bd2919e28df60e27f0c9e
SSDEEP 3072:mQzZMnRfxLO7ATq5k29RE7sCc2sjjxIE2dtWWzqJSsM+M:eNUQ
TLSH
T192048487CA7D45BB30134BE3C769AC594962272D535E0B1C22EF92CEE045A03D5BE4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 686496ec6cee34b6ab244bc7e9e8456576864340e8e9a8600309e158ad4e6041
MD5 d87b86a46c722d99793a3c6ae9518416
SHA1 3df4d64eddad1b4ff5db1745afa0630d500e3c62
SHA512 4d64db4f3ec150341685ab9dfe3289fa07e82960f9a74e675103fa1961f4319be1c12e3f6d57a5555519698ed8be2349d41e025880f452fe1621a0d42063ad38
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOCYA+wdn:G6F0eMpAAYEhpYhwx
TLSH
T11E456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 e2df40086237bef3b2e99584d028ffe0867d98fe1e3e569007024aea4e2ecf8c
MD5 3bc24cd58a01930aa0c594cdf6eb6e3b
SHA1 c82333b6b96d658e0f78ed00564dd453891b5cfe
SHA512 adda7ca024d8e6fe68784ea06c7b78f05fa5c5d08e2fb96ae21b235712390bbf0ff2fd313bc7d949718ef13af67266406e56fcbae0622dd88e270ef1fea20a1a
SSDEEP 24576:W7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+wB0:t6F0eMpAAYEhpmhwS
TLSH
T11C456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3504-319-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads