Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 03:39
General
- Target 2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
- Size 6.7MB
- Sample261017-d7neysgz6m
- SHA256 e36350ebf2ce69b4c89815775681cb8d98427765810b979086c3be3ea03c5ca0
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 33 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\7C498A15CD9C1F11B8756DA40BEBAFA9\2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"C:\Windows\temp\7C498A15CD9C1F11B8756DA40BEBAFA9\2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7E5A7C15CD9C1F11B8756DA40BEBAFA9\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\7E5A7C15CD9C1F11B8756DA40BEBAFA9\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADNwoUASVNBlT9aTxUvnzfsAjQAAHAL//94BT8n/DKrWi8AGQAHAFEAcAByAHcAaAB6AG0AYQAAAAcAMQAwAC4AMQAyADcALgAwAC4AMQAzADYAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
downloader_it-IT_PREMIUM.ini
mykasperskyfeatures_it-it.txt
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
2026-10-16_eb994f061ecfd7ac43686cffbf426abc_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
memory/2928-10-0x0000000077470000-0x0000000077480000-memory.dmp
memory/2928-12-0x00000000772F8000-0x00000000772F9000-memory.dmp
memory/2928-7-0x0000000077470000-0x0000000077480000-memory.dmp
memory/2928-8-0x0000000077470000-0x0000000077480000-memory.dmp
memory/2928-11-0x0000000077470000-0x0000000077480000-memory.dmp
memory/2928-9-0x0000000077470000-0x0000000077480000-memory.dmp
memory/3344-104-0x0000000006970000-0x0000000006F2A000-memory.dmp
memory/3344-122-0x0000000007B50000-0x0000000007B66000-memory.dmp
memory/3344-102-0x0000000005FD0000-0x00000000063AE000-memory.dmp
memory/3344-103-0x0000000005C60000-0x0000000005CC6000-memory.dmp
memory/3344-118-0x0000000007B80000-0x0000000007BC8000-memory.dmp
memory/3344-105-0x0000000005F90000-0x0000000005FCE000-memory.dmp
memory/3344-98-0x00000000058D0000-0x00000000058E2000-memory.dmp
memory/3344-109-0x00000000065A0000-0x00000000065C6000-memory.dmp
memory/3344-49-0x00000000014E0000-0x00000000014EE000-memory.dmp
memory/3344-113-0x0000000006690000-0x0000000006750000-memory.dmp
memory/3344-57-0x0000000005530000-0x0000000005580000-memory.dmp
memory/3344-45-0x0000000072952000-0x0000000072953000-memory.dmp
memory/3344-58-0x0000000072940000-0x00000000730FC000-memory.dmp
memory/3344-94-0x0000000005730000-0x00000000057A2000-memory.dmp
memory/3344-134-0x0000000007C50000-0x0000000007C84000-memory.dmp
memory/3344-130-0x0000000007BF0000-0x0000000007C0C000-memory.dmp
memory/3344-126-0x0000000007B30000-0x0000000007B40000-memory.dmp
memory/3344-46-0x0000000072940000-0x00000000730FC000-memory.dmp
memory/3344-194-0x0000000072940000-0x00000000730FC000-memory.dmp
memory/3344-193-0x0000000072940000-0x00000000730FC000-memory.dmp
memory/3344-192-0x0000000000570000-0x000000000063C000-memory.dmp
memory/3344-138-0x0000000007D50000-0x0000000007E04000-memory.dmp
memory/3344-191-0x0000000072952000-0x0000000072953000-memory.dmp
memory/3344-142-0x0000000007C10000-0x0000000007C30000-memory.dmp
memory/3344-143-0x000000000BF10000-0x000000000BFA2000-memory.dmp
memory/3344-152-0x000000000C070000-0x000000000C07E000-memory.dmp
memory/3344-147-0x000000000BFB0000-0x000000000BFF4000-memory.dmp
memory/3344-148-0x000000000C000000-0x000000000C008000-memory.dmp
memory/5416-4-0x0000000077450000-0x0000000077460000-memory.dmp
memory/5416-2-0x0000000077450000-0x0000000077460000-memory.dmp
memory/5416-5-0x00000000772F8000-0x00000000772F9000-memory.dmp
memory/5416-1-0x0000000077450000-0x0000000077460000-memory.dmp
memory/5416-3-0x0000000077450000-0x0000000077460000-memory.dmp
memory/5416-0-0x0000000077450000-0x0000000077460000-memory.dmp