ab62e4b36719040c1f26b9454cd08d33c8553227846002c2c1fd9c585d3d5ab0

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_e01918c7e63e0ad4d559deda4b8757cb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260925-w61yrsvs2l
SHA256 ab62e4b36719040c1f26b9454cd08d33c8553227846002c2c1fd9c585d3d5ab0
MD5 e01918c7e63e0ad4d559deda4b8757cb
SHA1 cd232c8293f4ec591e055438081dc09e65c33173
SHA512 1b889addb6fac54d8f9cf975d6572d22d6e00b4a73989fc6576b40517608f86f657955249f844c2d52795930a4b00d4a22b496bf0dfea2e60b3835a11fd4a5e3
SSDEEP 98304:Z0nAAYEp/h49OU/jIEeQfoR/IuOFVjUu5t:+Ng9FIF0wuf
TLSH
T1ADF59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2588	original_temp.exe
5088	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_e01918c7e63e0ad4d559deda4b8757cb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5088	original_temp.exe
5088	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2588	3404	2026-09-25_e01918c7e63e0ad4d559deda4b8757cb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 2588 wrote to memory of 5088	2588	original_temp.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-25_e01918c7e63e0ad4d559deda4b8757cb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_e01918c7e63e0ad4d559deda4b8757cb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\jds240742484.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240742484.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 5784bfa1465bc3ab926d7ba9071b42db6bb0e3b3bda31a6dd3c1b8dc1852c503
MD5 2bd7bfd9e073ea5f0b7ef1034fef1550
SHA1 3b3920088f80f488fed0bfac5351053803bf60b9
SHA512 aeec4845e02e526bfa7b75a4227efc4590a7ed6ef966b9ea5ea1bd23655a7821308dfaf3d77eb126009cccca2eae5d26535fd6fd0d507f08262384138b6d2083
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOvYA+w9v83npi63it:O6F0eMpAAYEhpThw58XpiMc
TLSH
T141756B50E7C780B1F97316F0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 51d86be960b85258590999ba947f9925a5ce7309f8202e8466787fcde24bad7d
MD5 3a7b33b44cab2606049cb0a80f866b06
SHA1 0935d9a1fecbaddfabbac80424d9e639eafd27dc
SHA512 5dab576d0cce1a30245b72adb2bfefdcee47540b3418c9e225a8967e9a5f19e47828d8199415ed0e19152d13ca89f518a2e51dd8fbf0ade21b76264ec1bcdff1
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wMDnMYenGJiKEbXWtG:66F0eMpAAYEhpphwCMPnRWt4/
TLSH
T102759E74E783D4F1E92300F1444BE7BA69349E1944318C7BEBC8EF15BAB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6E12.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6E12.tmp
Size 1.1MB
SHA256 cc16231aceb55aeb0fe701a55ec2884596b8606bd39435a1fdfee59afcbbb9dc
MD5 ae9cf838f82113a50683211bc6129eab
SHA1 237ddf21d8aab365aeb0aa73db44f948c8e24607
SHA512 41fa0f863fa17b3feb9ee42386b1bcccc11e5ba0e20f214835ac15c0d5754eaa4ad17f131aac8a17cd3b7abe8593379599e8e3f14bd2af5afa7657a3e46d4793
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOLYA+wM7:N6F0eMpAAYEhpHhwa
TLSH
T1EA456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240742484.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 3582b6da955ee1f5288488e624129abdb392c5a97e315c159d03a795be4a6f1f
MD5 4690ecc5ee2fb559772f0f9e539e161b
SHA1 42f7aba8b07b4c02e9b2039b5a2e1c014ad7c152
SHA512 a5c128661911645bb810132984eeefae9d04746f644cbfd792b33ef53f63893054e4bced1fd571536fc0d0944f0d22116ce51935b9306b773a99b88c5de2126e
SSDEEP 3072:Isn5U1t+kTcr43uBACl1YrAGqDBGGM/h1AJBZfIAkDO:+iTd
TLSH
T1D6F38587896E45BB30130BE7C3695C649422272E535F9A1D31EF86CFA445A03C67F8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 a0f059a3c0c277a14667f0a3d57273702a9488a80ea8c8a6148a87e047a2ffa4
MD5 d38e3419e1726a46db2bab61ce2c83ad
SHA1 65041c2ba5c32300d2c985c4578061861ae55772
SHA512 35ddd79b8c4518a18637ae53c90a6f08bcf7cb14562174cf9573a4dc28d691913145824aa26c57815a513b50d9433c36a5917f3c8cf68e5dd5cba5e0f076a41b
SSDEEP 3072:Isn5U1t+kTcr43uBACl1YrAGqDBGGM/h1AJBZfIAkDE:+iTZ
TLSH
T197F38587896E45BB30130BE7C3695C649422272E535F9A1D31EF86CFA445A03C67F8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 2f62eab5dbef9bf3b63c0a61b1ee9b716d990f0c31e8e0555e03a48535f685d0
MD5 7a76ee31872c9949f32eaf45be1ba0b0
SHA1 55743e2bfec48d2fa0f7792931758dc46c095f6b
SHA512 63d8f68e3be221ce77cfc6ac3d65da63e92b28f3e5d6ff9c75b810b1d330524f460cf8a36b2e22ed91267ddd16d44ae31c576f8fe4a2aef67e3532a90eada9a6
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3YA+w9X:26F0eMpAAYEhp/hwh
TLSH
T1C3456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 1a62ebf35d4409f80a01c4e2e0a9c72effc9b9cca0cdeaf396ab554fd07ce1a1
MD5 0f1e2e82c30dcac540e3b6d6a0b9450b
SHA1 255ef711fa9dead488978ef63a128b2b0e5b5c3f
SHA512 ca91ad04ec2552652b47e956932b132d8dbfee4df42bb1fe10819d4c36509a03397fc4b66354851dd180ccfa98ac2385b5937dde07b5b0b14d74bbd35419c916
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQYA+w0h:W6F0eMpAAYEhpuhw4
TLSH
T11C456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3404-320-0x0000000000400000-0x000000000052A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads