027f64638fef5f2c4421838b83fb8fdcae730cb210b463e6ec11114779da51e5

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_4b71166776a85456893ff43ee1a4b3b9_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Size 5.6MB
Sample261002-smfa6swxfs
SHA256 027f64638fef5f2c4421838b83fb8fdcae730cb210b463e6ec11114779da51e5
MD5 4b71166776a85456893ff43ee1a4b3b9
SHA1 db97cf3278f743e36f3911072e8588161dc174c1
SHA512 86f8a39e158627113fdac3e1f87d0c520a13bb7c8ac5ff66488aaf5573bd4e6e8575dc0904b3c4ea8c25e3555c0ed4134a8cd284f6189f97f10619e3938f5d95
SSDEEP 98304:WPJjzrZtnNrk1x+yhlqdjlBH7GWQOuwu2J2m7VHBU09cv8JVNFmQNvN:EV3WnqxHweHAv8J9v5N
TLSH
T1C256027726514121D0E28C36863BBEB5B1F812366B01B8FFB7D8D9C516310E1BAB26D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	4372	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_4b71166776a85456893ff43ee1a4b3b9_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4372	2026-10-01_4b71166776a85456893ff43ee1a4b3b9_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
4372	2026-10-01_4b71166776a85456893ff43ee1a4b3b9_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_4b71166776a85456893ff43ee1a4b3b9_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_4b71166776a85456893ff43ee1a4b3b9_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 1364
  2⤵
  - Program crash
  PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4372 -ip 4372
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E4A3FD2.exe

Path C:\Users\Admin\AppData\Local\Temp\E4A3FD2.exe
Size 5.6MB
SHA256 610b28d799ae902e15615d09ff2b49e9b7e372cd28a3f4cc5083384ead155528
MD5 dd71af12b252e7392f88652c3fe809bf
SHA1 3426f049c32ab54439e6f6e3d1ca209a718e7638
SHA512 4664170bb251b309d3c76921a3b0fb3434a609e2e41ecbd3c90d7eb04f153b1b73c7cbf97192cd1d9ea8e0149236a8ab85feafd44a25cf9005af26ad6328f78e
SSDEEP 98304:HPJjzrZtnNrk1x+yhlqdjlBH7GWQOuwu2J2m7VHBU09cv8JVNFmQNvN:vV3WnqxHweHAv8J9v5N
TLSH
T16B56027726514121D0E28C36863BBEB5B1F812366B01B8FFB7D8D9C516310E1BAB26D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4372-0-0x00000000008A4000-0x00000000008A5000-memory.dmp

Download

memory/4372-2-0x0000000000E00000-0x0000000000E01000-memory.dmp

Download

memory/4372-6-0x0000000002A60000-0x0000000002A61000-memory.dmp

Download

memory/4372-4-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/4372-1-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/4372-5-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/4372-3-0x0000000002A30000-0x0000000002A31000-memory.dmp

Download

memory/4372-7-0x0000000000550000-0x0000000000AF5000-memory.dmp

Download