72950791823b9c72f128c24828e0d01a1259d6666d3aa1633f4c925ca644a961

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe
Size 2.4MB
Sample260502-ptc8lsfx81
SHA256 72950791823b9c72f128c24828e0d01a1259d6666d3aa1633f4c925ca644a961
MD5 59076bcafe6bb51a61bc3ba97c3649d1
SHA1 937b9aa436a6ccd79935efff1e9b2587eb8bfef0
SHA512 1cd68f1fad73f54937c7ff59953bb6d0ce3fb2741b32d2d2a31ec6da53d70bad984c020f727f82b7cec177b371467b34bfe337fcc773044230ac6d916a0cfb14
SSDEEP 49152:6oa1taC070Uy/SMDHCe8jlRmnJ4LKiU5woty9V:6oa1taC0SS4Z8pkJ4LKZK0
TLSH
T1B8C5D0A7E7818AE8E64D04366F558241D62EF231A70F5752799C061DCF8378B8F62E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5072	EC92.tmp

Executes dropped EXE 1 IoCs

pid	Process
5072	EC92.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC92.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5072	5064	2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\EC92.tmp
  "C:\Users\Admin\AppData\Local\Temp\EC92.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-02_59076bcafe6bb51a61bc3ba97c3649d1_amadey_elex_glassworm_smoke-loader.exe 9D04EB15D77B1EFAA7ABB552A8DDA361415BCB98C8A24CA98A829A711EBCE9A7DE008D272B3B3FD8F9AA46FE287DC23BC72109A63F3E26158F3EA06FE58BB21D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EC92.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC92.tmp
Size 2.4MB
SHA256 7697ef8aaf779160fa9bc3b67e23cf38e8334d1fabad51e7b5c11bc116ec4946
MD5 9b3428d7b5224d408350f0d8a53e089a
SHA1 5ea414487bce613fa83e5e655e95fda17e45b398
SHA512 cee142995fafab18b83f9a1e8393abf1822bcd408e1c6abf95084eac1352f64302d9a0c330b62b6b5c82bc26e217692a798762d5c00f3bfe5f485dca29ac04bb
SSDEEP 49152:6oa1taC070Ur2HrqqtUvXlLvbJP6yM01tV:6oa1taC0OqqtUt+
TLSH
T106C5E0A7E7818AE8E64D04366F548241D62EF231A70F5752799C061DCF8378B8F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5064-4-0x00000000025B0000-0x000000000283B000-memory.dmp

Download

memory/5072-7-0x00000000025D0000-0x000000000285B000-memory.dmp