c908f4742e69bbb5a89ed2090d7a00d41390a12e34392cbc1ce3e9d585e4b998

Analysis

max time kernel
150s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.0MB
Sample261102-eazx6agz5n
SHA256 c908f4742e69bbb5a89ed2090d7a00d41390a12e34392cbc1ce3e9d585e4b998
MD5 efbea63046a4d83cab2f68e5918794b9
SHA1 f9375509ba049c8f0b8a047472c1d95d8a3eca5e
SHA512 d05917f012eacd4dd0d97dfa610a5fa14e63e571ae1d3d381feb2366d4e77bc904fc6edff827f5c0575063dde0269f309aed29e44a7251988eb5694e09fc76a5
SSDEEP 98304:pD6ZriGrDFObJbXfI2lVtgXmjP2x5FQCNrkVrwvJpG:pD6JrmbXfI2lVt44ux5Ri
TLSH
T1F2161272E6438632E7F22278D17A4E7E2E2C192217FC96D7D3902E6546701C367FCA15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation suricata

Malware Config

Signatures

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2124	cmd.exe
4	2124	cmd.exe
5	2124	cmd.exe
6	2124	cmd.exe
7	2124	cmd.exe
9	2124	cmd.exe
10	2124	cmd.exe
12	2124	cmd.exe
13	2124	cmd.exe
14	2124	cmd.exe
16	2124	cmd.exe
17	2124	cmd.exe
18	2124	cmd.exe
19	2124	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHFZFtG.exe	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
4372	tHFZFtG.exe
4628	tHFZFtG.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
3	2124	cmd.exe
3	2124	cmd.exe
19	2124	cmd.exe
19	2124	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tHFZFtG.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tHFZFtG.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tHFZFtG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tHFZFtG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
4628	tHFZFtG.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe
2124	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4208	4664	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	89
PID 4208 wrote to memory of 4372	4208	2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe	91
PID 4372 wrote to memory of 4628	4372	tHFZFtG.exe	92
PID 4628 wrote to memory of 2124	4628	tHFZFtG.exe	93
PID 4628 wrote to memory of 2124	4628	tHFZFtG.exe	93
PID 4628 wrote to memory of 2124	4628	tHFZFtG.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Creates a file in the Startup directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHFZFtG.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHFZFtG.exe" "C:\Users\Admin\AppData\Local\Temp\2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHFZFtG.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHFZFtG.exe" "C:\Users\Admin\AppData\Local\Temp\2026-11-01_efbea63046a4d83cab2f68e5918794b9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        5⤵
        Badlisted process makes network request
        Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tHFZFtG.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHFZFtG.exe
Size 3.4MB
SHA256 70b37871e243dcb815128e506c6297fc624c5e371891f58de011766150b4ef36
MD5 345fc5e8c5169ab09ef0f764c2130f7a
SHA1 45a9454e0a68f4ad20cf16bb00572aa8b2ee719f
SHA512 35617c9ca19f36f7e42ddf9fd999eedc2b121dfcff30d61788ce26d4c24b336a4fdadfd8e45f241ac5b146b0dedffb46c323507ea1e62db5036544d92d5de92b
SSDEEP 49152:6LRI3sq3hdlLx4goiQZxiD48fKIYE34xUnfeZ6eH/3w47xd:6LNq9Lx4goiew3H4xUnfe9f3wcd
TLSH
T17EF522BB85354828DA9FD6FCC7BC68894F3C748D0502297C6667B3A9164DE01EF790E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-31-0x0000000000DD0000-0x0000000000E6E000-memory.dmp

Download

memory/2124-35-0x0000000000DD0000-0x0000000000E6E000-memory.dmp

Download

memory/2124-32-0x0000000000BF0000-0x0000000000C89000-memory.dmp

Download

memory/2124-25-0x0000000000BF0000-0x0000000000C89000-memory.dmp

Download

memory/2124-29-0x0000000000DD0000-0x0000000000E6E000-memory.dmp

Download

memory/2124-30-0x0000000000DD0000-0x0000000000E6E000-memory.dmp

Download

memory/4208-2-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4208-1-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4208-13-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4208-15-0x0000000002660000-0x00000000026FE000-memory.dmp

Download

memory/4372-16-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4372-21-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4628-20-0x0000000077058000-0x0000000077059000-memory.dmp

Download

memory/4628-24-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4628-27-0x0000000002860000-0x00000000028FE000-memory.dmp

Download

memory/4628-22-0x0000000077058000-0x0000000077059000-memory.dmp

Download

memory/4628-23-0x00000000029E0000-0x00000000029E1000-memory.dmp

Download

memory/4628-19-0x0000000002860000-0x00000000028FE000-memory.dmp

Download

memory/4628-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4664-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4664-11-0x0000000000400000-0x00000000007FE000-memory.dmp

Download