72950791823b9c72f128c24828e0d01a1259d6666d3aa1633f4c925ca644a961

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe
Size 2.4MB
Sample260502-ptc8lsfx81
SHA256 72950791823b9c72f128c24828e0d01a1259d6666d3aa1633f4c925ca644a961
MD5 59076bcafe6bb51a61bc3ba97c3649d1
SHA1 937b9aa436a6ccd79935efff1e9b2587eb8bfef0
SHA512 1cd68f1fad73f54937c7ff59953bb6d0ce3fb2741b32d2d2a31ec6da53d70bad984c020f727f82b7cec177b371467b34bfe337fcc773044230ac6d916a0cfb14
SSDEEP 49152:6oa1taC070Uy/SMDHCe8jlRmnJ4LKiU5woty9V:6oa1taC0SS4Z8pkJ4LKZK0
TLSH
T1B8C5D0A7E7818AE8E64D04366F558241D62EF231A70F5752799C061DCF8378B8F62E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2140	21E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2140	21E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2140	4748	2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\21E.tmp
  "C:\Users\Admin\AppData\Local\Temp\21E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe 41623ABF6C001F9C9416307D5F8646C9137369B32C3F70A126168C4142F19BC284C1A16BCB529B484AF836B1812A16FEAE1DEFD3E7D4FBC8E25FCF2094B318F1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21E.tmp

Path C:\Users\Admin\AppData\Local\Temp\21E.tmp
Size 2.4MB
SHA256 ae9966ee886b5035c79544bcef036b6b7a33530cb9ccb843d2803591ec7f59c2
MD5 bf6d5ff66cc6117ecfa1482ac694c608
SHA1 682f712524f82122786bb353cba88179745bc9a8
SHA512 56d59531c98ea0ce004abe801b8a8045e949d71f4bd7c2c283e53aae28c29a3108d4132157d26cc0b624b8d7744b9242713d17c76c2bf35c052b51b9a7aa3149
SSDEEP 49152:6oa1taC070Uc7WtBUwGeKEO04o+OlGUzwAcA9YV:6oa1taC0SCBUVeAG+6QK
TLSH
T152C5E0A7E7818AE8D64D04366F558241D62EF231A70F6752799C060DCF8378B8F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download