275d7198ec86ab203e2d2847caf6a520f7c51351a5d86c1f6eccb8409b30cefc

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample261001-y2dc1sswhy
SHA256 275d7198ec86ab203e2d2847caf6a520f7c51351a5d86c1f6eccb8409b30cefc
MD5 fe38ee2b878f2d12a7489a65df975e70
SHA1 48f61e0f6fcee408f18c856b2844c17d5103b88a
SHA512 97153c1effdf8d3f04247f0dda71d1eeef15d8c87265e26071906422967476d737bf4e8c6e503463f64747da3bfa19b3d3c495448b61400e0979305b26ee225e
SSDEEP 98304:00nAAYEpHhg9OU/jIEeQfoR/IuOFVjUu5r:BNI9FIF0wuB
TLSH
T1F8F59E11F6C6C4B1F5730171486AD7B95630BD65423288AFF7CCEA0AAF719C19A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1176	original_temp.exe
2256	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2256	original_temp.exe
2256	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1176	1844	2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 1176 wrote to memory of 2256	1176	original_temp.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe38ee2b878f2d12a7489a65df975e70_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\jds240776359.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240776359.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

au.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_381\au.msi
Size 853KB
SHA256 9d4d672be69c91207923ef3540af4750322c43e0a3440126fbf5b4962c8c3052
MD5 b1a4cf35bc6913071ee217125bcc6788
SHA1 4818a036d75aa943e92353b638ffd1636ba46c49
SHA512 5bfde958292748f666d61b72401426bc5ab4bd564299e806d9c05722812156d6f7742bd2482fca308fc10cc27747a1f0b216a4a2596540cc987b5402c4fcea04
SSDEEP 24576:le/bE//5CbZtbotwXYMNMUEcF72VUnVMM:o/4n5mbbX3MFcF72GnuM
TLSH
T15B0533D266E539100CD0E7B0A253A67C90FE774A3460996044637675CB0FBCB67ABB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF324.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF324.tmp
Size 1.1MB
SHA256 c2e9d538e20663db2cb358dbd39ba01545eb495a57b01b8ecead3dbef461254e
MD5 3d245c731b565fcbc8ba0ec2f6e8b17b
SHA1 7ceed45f840b755c3437b0ae101d855502feb64c
SHA512 7d15c8e2ecb95110c0e4e0c417054dcc9bb429192fee6714c2e8f7f928a7a6b3cb47f8d0f06afa74da5200adbe6229dd537b83ef5c033165564b614f69201ed1
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wMD:66F0eMpAAYEhpphwC
TLSH
T163456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240776359.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 3995ae7f3a4b129a09d9005dddeef0036c8093546800c475dd9e66f1d8074897
MD5 051e3bf376c9301e49039fb4e2ae6bc8
SHA1 3ffac23e49457b7dde1597d5e4b31ba1ffc021a7
SHA512 3ae3bb1e2389bb64c620d1413b5aa9955e7be0b3a94c40c5cfff2546ff1672a59ed630fc848bb83389fe5a1feb9b4765f0ec35d3471fe064f9d768b630a0a3fe
SSDEEP 3072:mQzZMnRfxLO7ATq5k29RE7sCc2sjjxIE2dtWWzqJSsd:eNUL
TLSH
T197F396878A7E45BB30130BE3C769AC594952263E535E0B1C61EF92CEE045A03D5BE4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 521ca9bc6808a8b1c17a803ebfb18ef7a5a8a8ee91981b1a26f51dba19537419
MD5 91bc18d444eb5f2e477b91d0481a4bb7
SHA1 82a390b8cd2fa4ffe2fd3b5c1b057df388c269ef
SHA512 6cfd689a90525b3f83f29ff5a95903c21aaca32d5e2171cbee664d96839d32501e1ca34245455728ad7d745ef376a6f97af8a8c0592f7f854af457c13c9ca487
SSDEEP 3072:mQzZMnRfxLO7ATq5k29RE7sCc2sjjxIE2dtWWzqJSsM:eNUW
TLSH
T151F396878A7E45BB30130BE3C769AC594952263E535E0B1C61EF92CEE045A03D5BE4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 9f62eb457f43021c12a013081f46120ba42eefaf3f03257f20b5120c98c11935
MD5 6b901b4da82caa1e3abcdd71483ec79e
SHA1 0eb72c8cb51853773005dafe690cda6828977a6a
SHA512 07b1007d4a0e8247784dc49fc667fa72e957222f86cd6f7b5d48ba8115a8a5b9dc0ef09a1d7cbae11042aeda45382c0af3005dd52dff3bee045f3590f674b135
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOLYA+wl7:N6F0eMpAAYEhpHhwt
TLSH
T173456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 19fa7a654ea57c33058bac781d5fca788215d342a2fe99a87cb46af1db505527
MD5 78b1d4aabe41520a98a63257c09eb23d
SHA1 0f2d8a202606275ed9130623a4b9be93df49035c
SHA512 54805317bb87eae174aca9a30a1913d978142bad06b2cc9c4fb2ee8c4d3daaed076f159014a5fda6d797c19867e319cd1feb61e9b00d7823ac7ea921379abcb4
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzYA+wMV:m6F0eMpAAYEhpHhwY
TLSH
T157456D94E783D4F5ED2314F0444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 c9b7d6b0f6c4408dd1c195f439049c6f818d0003547ad156209ff0e849a8331a
MD5 45cf81c045ca5950cfb9041db51ec6b7
SHA1 f4d4d1d7f97063387d0318f21da617c8379b41c4
SHA512 e510e23168bff187c68ad51692f26456d3848ef9a469d11493edaea871320a78667f7eabc2197b9522f33c2482fa79d4d68887841d8fec3870c6a812c883ded6
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOZYA+wlz:e6F0eMpAAYEhplhwl
TLSH
T170456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-347-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads