77c1ab86bee877e327d1774f3e9353edd76c82193ece2e5f4b6fe9060df152aa

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_96f19f742de43eefc83acef72637c5d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample261022-tyhfcastdw
SHA256 77c1ab86bee877e327d1774f3e9353edd76c82193ece2e5f4b6fe9060df152aa
MD5 96f19f742de43eefc83acef72637c5d7
SHA1 382a2074a780fdb09472f7375d9c17a4123fe638
SHA512 cf6ffe47b0633afbd131660883c2662135d4528dc9dd36e0df8b7f0c63eb8603695091a3fad63dfcf292b822c7e0da5f37be83e5e8f79fd4553826fbedf10d3e
SSDEEP 98304:B0nAAYEp3hkOU/jIEeQfoR/IuOFVjUu55:WNUFIF0wuD
TLSH
T1AEF59D11F6C2C4B1F57311B1486AD7B95530BD65413288AFF7CCEA0AAF719C29A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
796	original_temp.exe
3008	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_96f19f742de43eefc83acef72637c5d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3008	original_temp.exe
3008	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 796	4536	2026-10-21_96f19f742de43eefc83acef72637c5d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 796 wrote to memory of 3008	796	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-21_96f19f742de43eefc83acef72637c5d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_96f19f742de43eefc83acef72637c5d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Users\Admin\AppData\Local\Temp\jds240733875.tmp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240733875.tmp\original_temp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

au.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_381\au.msi
Size 853KB
SHA256 9d4d672be69c91207923ef3540af4750322c43e0a3440126fbf5b4962c8c3052
MD5 b1a4cf35bc6913071ee217125bcc6788
SHA1 4818a036d75aa943e92353b638ffd1636ba46c49
SHA512 5bfde958292748f666d61b72401426bc5ab4bd564299e806d9c05722812156d6f7742bd2482fca308fc10cc27747a1f0b216a4a2596540cc987b5402c4fcea04
SSDEEP 24576:le/bE//5CbZtbotwXYMNMUEcF72VUnVMM:o/4n5mbbX3MFcF72GnuM
TLSH
T15B0533D266E539100CD0E7B0A253A67C90FE774A3460996044637675CB0FBCB67ABB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4DAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4DAA.tmp
Size 1.1MB
SHA256 2932e88e21ded6801a0d13cf528f699f57067cebcd424d21bacbb45a82d7ad89
MD5 f61c546667a4d88388fac2b2d7107dc9
SHA1 f96dad991b09ac30c25d4a9cad8b55cff41ab28e
SHA512 a21af1eab488a2ca8eadc6f06b1106e0359d6ab231a8f97ea6c9d53ac9d5979359ca822ed8bf289884de5de1c423961f58f056c8ea6fc9cea3716a8f88c0233d
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4YA+wh:F6F0eMpAAYEhpKhw
TLSH
T1F9456D94E783D4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2D522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240733875.tmp\original_temp.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2841eb3b5cfaa2ffc9b9dce8ebd5ea35458492d97e072a1e5271259d954390e6
MD5 6092ac322d2789ffcaf557fa2b645b09
SHA1 8a236223797b6451e816e5ebb64f18e2f8dc03f0
SHA512 5711737ce11a84bae6d2c866e173e1f36d8ebd9f4e4114b4f179d267c533c543c161ce9f088ea4520005fa53cd7c97dce4b394d6dc051f0858bccdac1d413256
SSDEEP 3072:kwmVhMp2UWvVkuXdZlB6HFvhAMSttTTZdhQ4hcKtiluRgPr:2Ynr
TLSH
T135F342568A3F457B34131BE3D7A96DE54656520A835E0E1C62CF92CEE081D03863E6FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 166KB
SHA256 205ae5c7f9c19993091f6386bae263fccbc63c9ff7814b6629688841f13e9bd9
MD5 58857a50ab29491b62ed1b0141372c2c
SHA1 1d8eb08984c24f8ba0f36adeb71cef7224455022
SHA512 1e65a966b1c788c0edd50201653661ebbf72231be31ab05149b6193ab6c9a4b35f12780ac89f6b84de73dff14e927741c786a8bc4bf4a51c0d31c03acfa6ef55
SSDEEP 3072:kwmVhMp2UWvVkuXdZlB6HFvhAMSttTTZdhQ4hcKtiluRgPm:2Ynm
TLSH
T16AF342568A3F457B34132BE3D7A96DE54652520A835E0E1C62CF92CEE081D07863E6FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.2MB
SHA256 5cb03fddbe1e55a14282171eb4768a8cffa1d12a7123a63caba364c8f5495a54
MD5 d6d7f90978a6aa6a4bb1eaa53154881d
SHA1 9a2e8a8464bf5b28229faea669f2ae6d6a0973d2
SHA512 ff8190d9fdc1cee5838c31808bf347af089624c9fe971c10fe8cecfd39a6cafde13dfc82694184e854e9e734d66ae1f0a961fcef4afd8b2740eb2c6afbf51e06
SSDEEP 49152:pOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Q:pOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1CAB58D12BAD58432F1B312319DB8C2695674B9A6473685EFB3CC561E4F30AC18E32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 9bfe2766b3de93ba31e953de9327f0b10f14170be9734763df74c147c6799d9a
MD5 6f9243a23d2db0d490b4c006cc6ce0fe
SHA1 1374736ff22a1c405a2507f0f6df238893e1cb7b
SHA512 918e6ac35283b7f4e49e6377bfa67abc5a004703d46ceb88e20b628c47abfe09fa89e60be2bd6e258c8844cc398e28ebb7e0e1479ba706031c0af81ce3d99dc9
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzYA+wk:+6F0eMpAAYEhp3hw
TLSH
T182455D94E783D4F5ED2314F1444BEBFBA5309E1A40318D2BFBC8FE11BAB2D522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 1a7fd0c5d70a4251db5844715ea097d3d41e550b8561068fe3073aca7feb8af2
MD5 134b296ea6760c7b04922aa8f172e7aa
SHA1 af9c416ff8a653023b9172c79efa49ae673be055
SHA512 ba4621a7036890a7b64e9527ee3c422eddfadd5090027c818683afaa77faafa703914beb43a337a9dfde0436eacddc29b6ea2a234b09124a89739b1b2b3403f1
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3YA+wR:e6F0eMpAAYEhpbhw
TLSH
T119455D94E783D4F5ED2314F1444BEBFBA5309E1A40318D2BFBC8FE11BAB2D522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 8fd9fa6a72cf53902955ff6c3c2ed70b73fa8f407fe9e4e265b1aff8d999c89d
MD5 5b57bc9b515f098839a3cc8d9c9b9611
SHA1 6ffac2fa66d90284b7b3def8237a9967babf0e58
SHA512 c88dc4e7a35dd3ea105420be4e4952b8d831dcedb3af5ef0daf14a62489cc5780f9bd777f662c18dcbe3c6521ed91cd28767116c98d2299eacb8370c1c3ced2b
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODYA+wm:F6F0eMpAAYEhpHhw
TLSH
T13E455D94E783D4F5ED2314F1444BEBFBA5309E1A40318D2BFBC8FE11BAB2D522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4536-335-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads