Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/10/2026, 01:32
General
- Target 2026-10-11_2d6af556fb17542182024194fff10b67_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 6.6MB
- Sample261013-byd4taxyes
- SHA256 95854d782af2800822c95c6ccc8d62c8b8e7744c78f11c1da18d32b4e8a4ef3c
Malware Config
Signatures
- Family: Beapy
Beapy is a python worm with crypto mining capabilities.
- Contacts a large (8970) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Loads dropped DLL 29 IoCs
- Domain Trust Discovery 1 TTPs
Attempt gathering information on domain trust relationships.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Permission Groups Discovery: Domain Groups 1 TTPs
Attempt to find domain-level groups and permission settings.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_2d6af556fb17542182024194fff10b67_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_2d6af556fb17542182024194fff10b67_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_2d6af556fb17542182024194fff10b67_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_2d6af556fb17542182024194fff10b67_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c wmic ntdomain get domainname3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ntdomain get domainname4⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net localgroup administrators3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net group "domain admins" /domain3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet group "domain admins" /domain4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
C:\Windows\SysWOW64\netstat.exenetstat -na3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Discovery
Domain Trust Discovery
1Network Service Discovery
2Permission Groups Discovery
2Domain Groups
1Local Groups
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Crypto.Cipher._DES.pyd
Crypto.Cipher._DES3.pyd
Crypto.Hash._MD4.pyd
_ctypes.pyd
_mssql.pyd
ii.exe.manifest
msvcr90.dll
python27.dll
select.pyd
win32api.pyd
win32event.pyd
Crypto.Cipher._AES.pyd
Crypto.Cipher._ARC4.pyd
Crypto.Util.strxor.pyd
_hashlib.pyd
_multiprocessing.pyd
_socket.pyd
_ssl.pyd
bz2.pyd
pywintypes27.dll
m2.ps1
memory/4048-87-0x0000000003790000-0x00000000037A5000-memory.dmp
memory/4048-58-0x0000000003030000-0x00000000030AC000-memory.dmp
memory/4048-70-0x0000000002F10000-0x0000000002F20000-memory.dmp
memory/4048-47-0x0000000002E40000-0x0000000002EF5000-memory.dmp
memory/4048-43-0x0000000002E30000-0x0000000002E3C000-memory.dmp
memory/4048-83-0x0000000003780000-0x0000000003790000-memory.dmp
memory/4248-89-0x00000220EB220000-0x00000220EB242000-memory.dmp
memory/4248-97-0x00000220EB9A0000-0x00000220EBAA0000-memory.dmp