ac68a69f561f2358c849b5f624bd9d1fc3db9db2bc7fd3de673c1f9ffe90b163

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_59f7f1491efe89df7c19a346c7c535ab_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260928-s2bljabe75
SHA256 ac68a69f561f2358c849b5f624bd9d1fc3db9db2bc7fd3de673c1f9ffe90b163
MD5 59f7f1491efe89df7c19a346c7c535ab
SHA1 251d58ecb8c4ba236665ea0a6db222c0a937c199
SHA512 5570bed5bbb12f934819a01e73f38cc62c89c00e0b59d4a5ad834fe01c94c6f996639c9c62600d125c4a34aa07dab599d14c2b120aea264615dc2a7d982bbc9e
SSDEEP 98304:B0nAAYEpchz9OU/jIEeQfoR/IuOFVjUu55:WNq9FIF0wuD
TLSH
T1D9F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2012	original_temp.exe
3748	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_59f7f1491efe89df7c19a346c7c535ab_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3748	original_temp.exe
3748	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2012	4116	2026-09-28_59f7f1491efe89df7c19a346c7c535ab_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2012 wrote to memory of 3748	2012	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-28_59f7f1491efe89df7c19a346c7c535ab_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_59f7f1491efe89df7c19a346c7c535ab_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\jds240727750.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240727750.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX34F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX34F4.tmp
Size 1.1MB
SHA256 d3c5ef453d0c3b7d791679d15c3c82637335b63d777ebf403f782d9ae9cc0c36
MD5 1a7a4f0ac80fd181ee4a898b5ce35194
SHA1 1b36f28cfaef3af44b0a2408d8cc2a642d033a20
SHA512 f84cd1150d4cbfc48d2a33c9c40642813011b625961a0c39ecda79fd105952a5c4cc657bb2244ed5a3fda06a4ba7fb7b80dbcc29856f6b11463dbc5736971b22
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6YA+wOh:m6F0eMpAAYEhpEhwq
TLSH
T133456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240727750.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2cdd14b144c2250b19966a752f37bfc69c55732926fe25fb23becc01b9345a41
MD5 5519117196afbc2dc6699b739f753a30
SHA1 8778275799f4836931165f64518b60a1e690b332
SHA512 28af4b66a121ae14ff369f9633a00ba08f90c60087bec78da9512e23b862d3d118cdf1a677a74d18c8cb3bbb6040b3f73ff74680e2110d7c3ec4be7d940ea98f
SSDEEP 3072:YyDJ0BPPt3zWQAJdB9RqPrBXUMmpp7dyO0+keVWh3Mth:1X2Q
TLSH
T1B8F37387C66E44BB30530BA7C37A9C585666171D935E4F1C61EF82CEE081E03C6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 d72c2a8a1afa83f9f45a3b86345e0d6714cbcf3c64d6c79076b50ad1343e5744
MD5 abf2e5ad56e65d40760bc677dddf4bbd
SHA1 0ee5266fd615909c6189deb5c0fdb824487b0ffc
SHA512 3f8ea84deec6589d75e3a2bb04bc04288856ab7c4da1075b3f1fd7f1b4fcdb93d235c5b740e62516666aafde87ccd77c143f2ae7178d89597712c3d160254ddf
SSDEEP 3072:YyDJ0BPPt3zWQAJdB9RqPrBXUMmpp7dyO0+keVWh3Mti:1X2R
TLSH
T1F6F37387C66E44BB30530BA7C37A9C589666171D935E4F1C61EF82CEE041E03C6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 1e9e4b9d1719973991b0a4af7dc01b7976855342c6b5dd4ab6c10a5d5958fe0e
MD5 b73a7f404caabd78dd57f456eaefb73c
SHA1 0ca67d08122599e27c719a27192368f8c7a5596e
SHA512 b1d86b17573c175934116ddbf5ccfbd11601becb228f28997538372fc2f9066def0a7da6be3c1b348faa447e4c5a04d1e570919f4131f24b02159801c31fdcb5
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOaYA+wO5:+6F0eMpAAYEhpchwC
TLSH
T120456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a9516bd56e681cd856b5d4f594e04d4a37228998b49ec9935b5d6031b34a1663
MD5 6110fefb3ef1aef4bd88f7426527ae9c
SHA1 312ff33084d48ccbddf266a6a4ddc25e07c553f5
SHA512 eedcf866e0dbabfef09eb2a5ffb7ba7a95dd5e6bff889e3811be9aff10f6def69a85e8a40c8361bce5cc97f678f6199c0b7cf32a1ed7297188fdb1abebfb6569
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOKYA+wjD:96F0eMpAAYEhp8hwv
TLSH
T1A7456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 803bb63800369c7dfe50bc5e9b2b4011815685a4eb75a9f5de784b97cedc0d62
MD5 dc0fe63b4df021a4292151d0b82315d4
SHA1 8ff7766ccb10fec48bc5e8e8ae412498757f5478
SHA512 1918feac1f2e3645d16c3e3bc0efe6fd2fa647610c35ee7c46594517e7de09f1010ddeb798c6f9446e6eb9cffc5574ee1a43e9a11b63735aa11cd7a6ca4db780
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wG3:N6F0eMpAAYEhpdhwE
TLSH
T17A456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 9b35815ebaf08205f83a9f267012140292a674b9b51551a6e660bc3c465c84e7
MD5 e06ab21ce3ffe1e5e32b517d63e0853f
SHA1 fb73fcf684fea804ecb14315bbebfff26714f810
SHA512 50bdbcc2c34bf615b9604063776ecb43867c0922ac121a9b931b2eae76cda36eef6af60608d928f7e74e0a6c66f85015cffa8d98200b28d516b05f46ef8d7593
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOaYA+wPY:O6F0eMpAAYEhp0hww
TLSH
T145456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4116-319-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads