528fd820aac38b8accd399eb40af0564aa8e88f4f724728c6260b1fbb3be7023

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_8cc9379d33416a30b31f16c2d273b6c7_amadey_elex_glassworm_icedid_smoke-loader.exe
Size 2.4MB
Sample260602-lpjcaaas8t
SHA256 528fd820aac38b8accd399eb40af0564aa8e88f4f724728c6260b1fbb3be7023
MD5 8cc9379d33416a30b31f16c2d273b6c7
SHA1 94b5e67680016f8554b03939da0a1ee395022075
SHA512 33dfa9f74eb4989518bf330aecd28642509aae3123f29ea7b446a86763d4c0b4528efff8ecb13eb27349431218a5a3a8ab3b480d6c379c4e3401eac4cc458adb
SSDEEP 49152:P5OVeyfDW3CTQQjxKWjFUsTWDcN20k5nQsrivkdh522NhYRZTI3Y:Oe6W3exKWSDcN20kSsrivkD5thYL
TLSH
T134B5BE527799C0E5EAA260B2C53096F286317C20D334A6DB35E0BD7EBE376C15A3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4160	AutoHotkey.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_8cc9379d33416a30b31f16c2d273b6c7_amadey_elex_glassworm_icedid_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4160	1144	2026-06-02_8cc9379d33416a30b31f16c2d273b6c7_amadey_elex_glassworm_icedid_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-02_8cc9379d33416a30b31f16c2d273b6c7_amadey_elex_glassworm_icedid_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_8cc9379d33416a30b31f16c2d273b6c7_amadey_elex_glassworm_icedid_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
  "C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe" /force "\\.\pipe\AHKHFCLMLMK"
  2⤵
  - Executes dropped EXE
  PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoHotkey.exe

Path C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
Size 1.3MB
SHA256 effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
MD5 2d0600fe2b1b3bdc45d833ca32a37fdb
SHA1 e9a7411bfef54050de3b485833556f84cabd6e41
SHA512 9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703
SSDEEP 24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
TLSH
T196559D0633E6C0E8DEB391F6C5299623D772781407389BDB25E0592DDFA3AE05B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-0-0x0000000000400000-0x0000000000665000-memory.dmp

Download

memory/1144-4-0x0000000001900000-0x0000000001910000-memory.dmp