3f1628fe9f56e723828a703c85fe4d73f14d4af3cefcd73cf1410e08412e5435

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_e71c5ec2d1584a4d33c15045b2ed5fca_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260502-ebjmkacy5m
SHA256 3f1628fe9f56e723828a703c85fe4d73f14d4af3cefcd73cf1410e08412e5435
MD5 e71c5ec2d1584a4d33c15045b2ed5fca
SHA1 575a4e3b89f3844653f39cce451617d53e2d5529
SHA512 d7dcea89578281aae39c4fd9c5e350154a52eab701a09ccead2bca2e9dbfb57c27e3edcc2e1ed364d7e3abac9c0c01a67d3100e4e34140fdc795a05fc310d88a
SSDEEP 98304:emhd1UryeF1JFjG40umgDmPXdV7wQqZUha5jtSyZIUbU:el11G4jtmfd2QbaZtliT
TLSH
T190869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3748	2F9.tmp

Executes dropped EXE 1 IoCs

pid	Process
3748	2F9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_e71c5ec2d1584a4d33c15045b2ed5fca_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3748	3408	2026-05-02_e71c5ec2d1584a4d33c15045b2ed5fca_amadey_elex_glassworm_poet-rat_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-02_e71c5ec2d1584a4d33c15045b2ed5fca_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_e71c5ec2d1584a4d33c15045b2ed5fca_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\2F9.tmp
  "C:\Users\Admin\AppData\Local\Temp\2F9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-02_e71c5ec2d1584a4d33c15045b2ed5fca_amadey_elex_glassworm_poet-rat_smoke-loader.exe 639E66DCCB16697C89FBA0CE7DFEE22DF9B632721B98C8388E77D94B06B5BF117A6CFFAA2899CAA37A8948439E59DB055E8CA0269F2ECB9A264F56C3E9949781
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F9.tmp
Size 7.8MB
SHA256 60e7c0dfb500a6babaec868acecf91d698b57b5dd21ab941689172e5db262197
MD5 f37584613e2a9bee5bee2bf6d0b4d2f1
SHA1 8a1fc9084be112dbcb80d158a95c1ddd069394d6
SHA512 2fdb2b6fe756f5b27d3e3f862be2b3ff6c1c01d22857e3efb009b2ab558d58a9bf8552718a3026c467dbeac69eaf24853b1a937aae43fae9afd6d38ead64d257
SSDEEP 98304:emhd1UryeqiWX74sMFV7wQqZUha5jtSyZIUbU:elVW4F2QbaZtliT
TLSH
T1EC869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3408-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3748-5-0x0000000000400000-0x0000000000849000-memory.dmp