ccdf5c14096c548c60f89bc01ca25121c77a85ad217aef55a71431d917826a90

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample261006-xb94macw7v
SHA256 ccdf5c14096c548c60f89bc01ca25121c77a85ad217aef55a71431d917826a90
MD5 9bee2b485567a41dfdeec39dece276d8
SHA1 261bfe045de828f0bc8491a520560811b30e9236
SHA512 ae40f8115a8cfd78b6b909f31190e9f5051daeba66001f2ab36ddd2da3e65c09d431014dae90d63a60c4ed0541cb04a102eb304cf585b8ee2cb0e184d41bc0ce
SSDEEP 98304:l7kaT9MEMYtCqO+nxGgHX7yOyMP9XVXtVrwvJpG:l7kaXHCqD0KXtPn9
TLSH
T188161220F684C172F7DB00F99176DAB65A3C5625236487CF5FC870B96EA48E1A339E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation suricata

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	4772	cmd.exe
13	4772	cmd.exe
15	4772	cmd.exe
16	4772	cmd.exe
17	4772	cmd.exe
19	4772	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j5cKlmhoM.exe	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2992	j5cKlmhoM.exe
4252	j5cKlmhoM.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 6 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
12	4772	cmd.exe
12	4772	cmd.exe
17	4772	cmd.exe
17	4772	cmd.exe
13	4772	cmd.exe
13	4772	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	j5cKlmhoM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	j5cKlmhoM.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j5cKlmhoM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j5cKlmhoM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4252	j5cKlmhoM.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe
4772	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4100	3648	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 4100 wrote to memory of 2992	4100	2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	93
PID 2992 wrote to memory of 4252	2992	j5cKlmhoM.exe	94
PID 4252 wrote to memory of 4772	4252	j5cKlmhoM.exe	95
PID 4252 wrote to memory of 4772	4252	j5cKlmhoM.exe	95
PID 4252 wrote to memory of 4772	4252	j5cKlmhoM.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Creates a file in the Startup directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j5cKlmhoM.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j5cKlmhoM.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j5cKlmhoM.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j5cKlmhoM.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-05_9bee2b485567a41dfdeec39dece276d8_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

j5cKlmhoM.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j5cKlmhoM.exe
Size 3.4MB
SHA256 cd312597282b088236100dc244d787610d3eb7ecc93fdbfb1f188c170c1940da
MD5 5e669dc0b35499af616bc08ed5276508
SHA1 99968769b72452d61033f58c4d5832d9510f92a9
SHA512 ca9ab282ce93286c532ae6dc7f3d0dcfef6389cf126f7dacbda150e93ef4bf5079b8350e7e44a08b672420621ccecca3f41f25e94f5b4656e64f1199c1cbfe0e
SSDEEP 98304:s9OaxxMwTucVJ9QK6TEHgsxvovJu6wzNaorRA/Z3a9K:WOhWfQKqEHLIw6UNNQ3o
TLSH
T1DBF5235A804B2F95D3608BFADBEDD652682EEC01C5FF0583778F34E646604A972D78B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2992-14-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3648-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3648-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4100-1-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/4100-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4100-15-0x0000000002680000-0x000000000271E000-memory.dmp

Download

memory/4252-19-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download

memory/4252-17-0x0000000002870000-0x000000000290E000-memory.dmp

Download

memory/4252-18-0x0000000077B08000-0x0000000077B09000-memory.dmp

Download

memory/4252-20-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4252-21-0x0000000077B08000-0x0000000077B09000-memory.dmp

Download

memory/4252-24-0x0000000002870000-0x000000000290E000-memory.dmp

Download

memory/4772-22-0x0000000001310000-0x00000000013A9000-memory.dmp

Download

memory/4772-26-0x0000000001760000-0x00000000017FE000-memory.dmp

Download

memory/4772-27-0x0000000001760000-0x00000000017FE000-memory.dmp

Download

memory/4772-28-0x0000000001760000-0x00000000017FE000-memory.dmp

Download

memory/4772-29-0x0000000001310000-0x00000000013A9000-memory.dmp

Download

memory/4772-30-0x0000000001760000-0x00000000017FE000-memory.dmp

Download